So, good afternoon. We are entering a period where software is no longer only a tool. For decades, software has executed commands, it has processed forms, moved records, calculated results, enforced workflows and connected systems.
But now, software is beginning to act more like staff. Not human staff, of course, not legal persons, not colleagues in the human sense, but staff like digital actors. We give them missions, we give them access, we give them tools, we expect them to coordinate, decide, escalate, delegate and produce outcomes in the real world. And once software can do that, the governance problem changes. The question is no longer only, can a model answer correctly? It's no longer only, can the application code appear securely? The question becomes, who authorized the work? Whose intent is being served?
What authority was delegated? What changed during execution? Who can stop it? And who is accountable when the consequence appears? That's why I want to start with a simple proposition. Once software becomes staff, identity becomes governance. Agentic AI is not only a model safety problem, it's not only an application security problem, it's a delegated authority problem. And delegated authority always raises questions of identity, ownership, control, evidence, liability and trust. Traditional applications usually live inside a defined interface.
They receive an instruction, they execute a function, they return a result. Agents are different. An agent may receive broad objectives and decide how to pursue it. It may select tools, it may invoke APIs, it may create subtasks, it may coordinate with other agents. It may adapt to context, it may act across organizational boundaries. That's why the phrase digital staff is useful. Not because agents are human, they are not. But because organizations are beginning to use them in staff-like ways. We assign work to them, we grant permissions to them, we expect outcomes from them.
And eventually someone must be responsible for what they do. This is already visible in agent-to-agent systems. We see emerging patterns where a remote agent advertises what it can do, where it can be reached, what skill it has and what authentication is required. That kind of discovery is useful. But the governance problem begins the moment the collaboration crosses a boundary of authority. Because if an agent can act, delegate and create consequences, then the relying party must know more than the endpoint. It must know who stands behind the agent. That brings us to the first hard question.
What makes an agent the same agent? For a human staff member, identity has continuity. A person can learn, change roles, gain experience and still remain the same person for the purpose of accountability. But with an AI agent, continuity is far less obvious. If a model changes, is it still the same agent? If the system prompts change, is it still the same agent? If the memory is reset, merged or shared, is it still the same agent?
If a tool chain changes, if a provider changes policy, if runtime changes, if a sub-agent is substituted, if a mission is transferred from one executor to another, what exactly is the thing we are trusting? And who is the owner who takes the responsibility? That leads to the next question. Who owns the agent? Every agent acting with authority needs an accountable owner. I call this the ultimate bot owner, UBO, just like in the finance world we say ultimate beneficial ownership. The phrase is deliberate. Ultimate bot ownership matters because accountability cannot stop at the shell entity.
You must know what it is before commissioning a work. Otherwise, the whole agentic network you are deploying will face an acceptable risk. It's for containing supply chain risk. Another dimension that I would like to introduce in this talk is the mission. It's not a prompt. A prompt is an instruction. It's not a session. A session is where the agent can continue working. A mission is different. A mission is governed delegation of intent. It's why the agent is allowed to keep working.
It includes the goal, constraints, authority, the resources, the duration, the applicable policy, the evidence requirements, and the accountability context under which one or more agents act. These concepts are orthogonal and must not be conflated. A mission may outlive an agent or it may terminate before the agent goes away. A session can be still going on when the mission was terminated, in which case it may be appropriate to terminate the session as well. An agent's action and session is constrained by the mission. They must only work to fulfill the mission. That mission must be bounded.
It must be reviewable. It must be capable of being suspended and must carry evidence with it.
Otherwise, agentic systems will not merely execute tasks. They will move authority around without reliable record of where that authority came from.
So, humans give submission to agents. Agents do autonomously form tasks and decide on actions. Since they cannot be accountable mostly, they often need to put humans in the loop to obtain authorization.
Of course, human oversight is important. For high-impact actions and so on that I have listed here, they may be essential. But at this point, we will face the scale problem. A worker may have tens or hundreds of agents. An organization may have thousands. A human cannot meaningfully approve every step.
At scale, oversight cannot be only human review. Human in the loop is not automatically meaningful governance. A person under time pressure looking at the compressed approval request and the incomplete information and yet pressing OK is not making real decision. That's automation bias with human signature attached. We need the help of an agent, AI agent, an oversight agent on the side of the principle. It evaluates the evidence and risk signals, filters out and escalates to the principles with relevant information when needed.
And it should sit on the side of the person or organization that originally delegated the task. It should be loyal to the principle, not to the system trying to complete the task. The acting agent should emit structural response back to the oversight agent when it formed an intent to execute something at the time of execution. Exceptions change the result. Shared signal style eventing can become part of the nervous system. But do we have a concrete standard to implement such a structured reporting system? Not yet.
Also, signals are not a kill switch. They are part of the signaling layer. We need control plane as well. The control plane must be able to intervene. It must be able to pause a mission, restrict authority, disable a tool, block delegation, revoke credentials, quarantine memory, escalate to a human or terminate the mission. Do we have a standard protocol for this? Probably not. There's another way to look at agentic systems. An agentic system is a distributed object system. It also is a distributed transaction system. A mission begins. The agent calls tools. It invokes APIs.
It delegates to sub-agents. It mutates states. It sends messages. It may create external consequences. In classical distributed systems, we have long known that long-lived transactions are hard. The Saga model frames a long-lived transaction as something that can be broken into sub-transactions while still being executed as a unit.
Now, what are the agentic workflows? It is a long-running transaction.
So, agentic AI systems face the same problem, but only harder. The coordinator may be partly non-deterministic. The executor may be model-dependent. The next step may be context-sensitive.
So, every sub-agent task, tool, or skill must declare its consequence semantics. Can it be reversed? Can it be compensated? Can it be fully recovered? Or is it irreversible? Sending an initial internal draft may be irreversible within the organization. Cancelling a booking may be compensatable. Repairing a workflow may be a forward recoverable. But disclosing confidential data may be irreversible. You cannot govern a mission if you don't know which parts can still be unwound. Agentic AI turns distributed transaction into distributed judgment.
And that judgment must be bounded, observable, and interoperable. This brings us to the agent card. It's a self-description of agent's name, provider, endpoint, capabilities, skills, authentication schemes, and interaction requirements. And maybe in one day, express its transaction properties like whether it can be rewound. They are important for discovery, capability declaration, endpoint discovery, and protocol selection. But we should be precise about what they do and they cannot do. An agent card may tell us what an agent claims to be able to do.
It doesn't by itself prove that the agent can do it or is authorized for the mission. It does not prove the runtime is trustworthy. It doesn't prove the model, prompt, memory, or policy version. It doesn't prove the ultimate owner. And it does not prove that the relying party should trust this agent for this transaction. A self-asserted agent card is not governance. It's an advising. Even a signed agent card only moves us one step forward. A signature tells us a key signed something.
The verifier still has to decide whether the signer, the key, the issuer, the trust framework are acceptable for this purpose. So, identification is not trust. Discovery is not authority. Metadata is not accountability. A useful analogy comes from Spiffy and Spire. Spiffy and Spire are not agent governance standards, but they show a pattern we should learn from. A workload should not simply announce who it is. It should receive an identity after the attestation. But for agentic AI, workload identity is only the beginning. Attestation can help answer what is running.
It doesn't answer whose mission is being executed, what authority was delegated, which model or prompt was used, which policy applied, and so on and so forth. So, we need workload attestation plus mission attestation, authority, evidence, and what trust framework. And this brings us to the federation. Agent cards tell us what is claimed. Attestation tells us something about what is running. Federation helps us decide who claims and attestation we should trust. OpenID Federation defines how entities that want to interface can establish trust through a trusted third party called Trusted Anchor.
It supports multiple level of authorities, and an entity may belong to more than one federation. It provides the technical trust infrastructure building blocks for dynamic and distributed trust networks. Federation helps us ask whether that signing key belongs to an entity in the trust framework we accept, whether there's a valid trust change, whether metadata policy has been applied, and whether trust marks are meaningful to this relying party. For agent governors, this is critical.
We don't want every party to manually decide whether every agent, provider, registry, attestation issue, or UBO is acceptable. We need trust change and metadata policy. We need a way to decide whose claims we accept before authority is accepted. And there are many useful components already from OpenID family of specs alone, we have these. Many of them are mathematically formally verified for its security. We should reuse what we can and build what we need.
Finally, we arrive at the question governors always reach in the end. Who owns the loss? If an agent leaks data, misroutes a payment, manipulates a workflow, sends the wrong instruction, or triggers harmful claims, change of actions, where does the accountability finally rest? That's why UBO matters. And it's why evidence matters. Without evidence, accountability is weak. Liability is speculative. Insurance is guesswork. The actuarial basis for agentic AI risks is still immature. That's not a reason to wait. It's a reason to build the measurement infrastructure now.
Insurance is not built on slogans. It needs exposure, frequencies, severity, control effectiveness, causality, and loss data. Software is becoming stuff. We need governors. There are standards that we can leverage, but it is not enough to build governable agent infrastructure. There are many gaps to be filled. Fellow Identirati, we are only at the beginning of a journey to build governable agentic AI ecosystem. Let us collectively start building now. Thanks very much. Thanks very much, Matt. Wonderful to have you back here on the keynote stage. Thank you so much for joining us this year.
We have one question. It says here, it's anonymous, it says, Dear Nat Sensei, are agent cards meaningful if agents are mostly ephemeral?
Well, yes, because even if it is ephemeral, you need metadata information. Agent card actually is a metadata, right? To actually start interacting with it.
Otherwise, you won't be able to interact meaningfully with it. So, yes, it is meaningful.
Okay, that's great. And so many organizations are already deploying AI agents experimentally, without mature governance models. So what do you think is the biggest single mistake that enterprises are making right now as they rush forward to AI adoption?
Hopefully, they are internally figuring out how to trace the liability and responsibility, accountability things, right? And also supply chain problems. If they are not, they are actually exposing their business to those humongous amount of risks without probably knowing. And if that's the case, they should actually look at what they are doing.
Okay, great, thanks. Once again, everyone, Nat Sakamura.
