# IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork

## Executive summary

Enterprises are adopting autonomous AI agents as a 'second workforce,' shifting focus from model behavior to operational safety and governance. The core challenge is managing agents that possess tools, private data, and delegated authority. To mitigate risks—exemplified by incidents like the Replit breach and zero-click CVEs like EchoLeak—the architecture must implement robust identity standards and strict privilege separation, ensuring that planning (intent) is separated from execution (action).

## Key takeaways

- Capability vs. Employment Readiness: A working demo only proves capability; it does not prove employment readiness. An agent with a goal, tools, private data, and delegated authority acts as an 'actor,' requiring governance controls like identity, owner definition, policy scoping, and reliable revocation.
- The Need for Agent Identity Standards: Current identity systems (like OAuth token exchange) provide the right shape but lack a dedicated agent identity standard. Agents require a defined lifecycle—provisioning, authorization, monitoring, and revocation—mirroring human employee management.
- Privilege Separation Architecture: To ensure bounded authority, the system must separate trusted intent from untrusted content processing. The Planner turns authenticated intent into a typed, logged plan, while the Executor runs that plan without holding standing credentials, preventing actions outside the defined scope.

## Technical details

- Agent Governance and Identity: Agents must be treated as managed entities with a runtime identity card. Key questions include: Who owns it? What subject is it acting for? Which policy governs its capabilities, and how quickly can it be revoked?
- The Lethal Trifecta: The primary attack vector involves the combination of private data, untrusted input (e.g., emails, documents), and external communication paths. Attackers often only need text that the agent reads to trigger downstream actions.
- Privilege Separation Pattern: This pattern separates the trusted planning phase from the untrusted execution phase. The Planner generates a typed plan based on authenticated intent, and the Executor executes this plan using short-lived capabilities, ensuring evidence can fill parameters but cannot mint new actions.

## Practical implications

- Implement a dedicated agent identity layer that tracks the actor, subject, and delegation context.
- Adopt privilege separation architectures where planning is separated from execution to enforce bounded authority.
- Treat all untrusted content (emails, documents) as potential instructions capable of causing downstream actions.
- Ensure audit trails capture not just compliance data, but every action taken by an autonomous agent.

## Topics

AI Agents, Governance, Identity Management, Privilege Separation, Cybersecurity, Enterprise Architecture, Deca Work, OAuth token exchange, Microsoft 365 Copilot, Replit

Source: https://www.youtube.com/watch?v=q-WOjZhOMCA