49 VIEWS
Pinterest LinkedIn LINE

Below is the transcript of my keynote speech at EIC 2026 on May 19, 2026. The slides are provided as a PDF at the end of this article.

When Software Is No Longer Just a Tool

Good afternoon.

We are entering a period where software is no longer only a tool.

For decades, software has executed commands. It has processed forms, moved records, calculated results, enforced workflows, and connected systems.

But now software is beginning to act more like staff.

Not human staff. Not legal persons. Not colleagues in the human sense, but staff-like digital actors.

We give them missions. We give them access. We give them tools. We expect them to coordinate, decide, escalate, delegate, and produce outcomes in the real world.

And once software can do that, the governance problem changes.

The question is no longer only “can the model answer correctly?”

It is no longer only “can the application call the API securely?”

The question becomes:

  • Who authorized this work?
  • Whose intent is being served?
  • What authority was delegated?
  • What changed during execution?
  • Who can stop it? and
  • And who is accountable when the consequence appears?

Software as Staff and its identity

That is why I want to start with a simple proposition:

When software becomes staff, identity becomes governance.

Agentic AI is not only a model-safety problem. It is not only an application-security problem.

It is a delegated-authority problem.

And delegated authority always raises questions of identity, ownership, control, evidence, liability, and trust.

Traditional applications usually live inside a defined interface.

They receive an instruction. They execute a function. They return a result.

Agents are different.

An agent may receive a broad objective and decide how to pursue it. It may select tools. It may invoke APIs. It may create subtasks. It may coordinate with other agents. It may adapt to context. It may act across organizational boundaries.

That is why the phrase “digital staff” is useful.

Not because agents are human. They are not.

But because organizations are beginning to use them in staff-like ways.

We assign work to them. We grant permissions to them. We expect outcomes from them. And eventually, someone must be responsible for what they do.

This is already visible in agent-to-agent systems. We see emerging patterns where a remote agent advertises what it can do, where it can be reached, what skills it has, and what authentication is required.

That kind of discovery is useful.

But the governance problem begins the moment that collaboration crosses a boundary of authority.

Because if an agent can act, delegate, and create consequences, then the relying party must know more than the endpoint.

It must know who stands behind the agent.

Continuity and Consistency of Agent Identity

That brings us to the first hard question.

What makes an agent the same agent?

For a human staff member, identity has continuity.

A person can learn, change roles, gain experience, and still remain the same person for purposes of accountability.

But with an AI agent, continuity is far less obvious.

If the model changes, is it still the same agent?

If the system prompt changes, is it still the same agent?

If the memory is reset, merged, or shared, is it still the same agent?

If a toolchain changes, if a provider changes policy, if a runtime changes, if a sub-agent is substituted, if a mission is transferred from one executor to another — what exactly is the thing we are trusting?

And who is the “Owner”, who takes responsibility for its action?

That leads to the next question.

Who owns the agent?

Every agent acting with authority needs an accountable owner.

I call this the Ultimate-Bot-Owner.

UBO.

The phrase is deliberate.

Ultimate bot ownership matters because accountability cannot stop at a shell entity.

You must know what it is before commissioning a work.

Otherwise, the whole agentic network you are deploying would face unacceptable risk.

It is for containing supply chain risk.

Mission

Another dimension that I would like to introduce in this talk is the mission.

It is not prompt. A prompt is an instruction.

It is not session. A session is where the agent can continue working.

A mission is different.

A mission is governed delegation of intent. It is why the agent is allowed to keep working.

It includes the goal, the constraints, the authority, the resources, the duration, the applicable policy, the evidence requirements, and the accountability context under which one or more agents act.

These concepts are orthogonal and must not be conflated.

A mission may outlive an agent, or it may terminate before the agent goes away.

A session can be still going on when the mission was terminated, in which case it may be appropriate to terminate the session as well.

An agent’s action and session is constrained by the mission. They must only work to fulfill the mission.

That mission must be bounded. It must be reviewable. It must be capable of being suspended. And it must carry evidence with it.

Otherwise, agentic systems will not merely execute tasks. They will move authority around without a reliable record of where that authority came from.

So, a human gives a mission to agents.

Agents do autonomously form tasks and decide on actions.

Since they cannot be accountable mostly, they often need to put human in the loop to obtain authorization.

Of course, human oversight is important.

For high-impact actions, legal actions, regulated decisions, financial transfers, external communications, or irreversible disclosures, human judgment may be essential.

The Problem of Scale

But at this point, we will face the scale problem.

A worker may have tens or hundreds of agents.

An organization may have thousands.

A human cannot meaningfully approve every step.

At scale, oversight cannot be only human review.

“Human in the loop” is not automatically meaningful governance.

A person under time pressure, looking at a compressed approval request under incomplete information and yet pressing OK, is not making a real decision.

That is automation bias with a human signature attached.

We need the help of an AI agent – An oversight agent on the side of the principal.

It evaluates the evidence and risk signals, filters out, and escalates to the principals with relevant information when needed.

And it should sit on the side of the person or organization that originally delegated the task.

It should be loyal to the principal, not to the system trying to complete the task.

The acting agent should emit structured reports back to the oversight agent when it formed an Intent to execute something, at the time of execution. Exceptions. Changes. Results.

Shared Signals-style eventing can become part of this nervous system. But do we have a concrete standard to implement such a structured reporting system?

No.

Also, signals are not the kill switch.

They are part of the signalling layer. We need a control plane as well.

The control plane must be able to intervene.

It must be able to pause a mission, restrict authority, disable a tool, block delegation,

revoke credentials, quarantine memory, escalate to a human, or terminate the mission.

Do we have a standard protocol for these? NO.

Agentic AI Systems Are Distributed Transaction Systems

There is another way to look at agentic systems.

An agentic system is a distributed object system. It is also a distributed transaction system.

A mission begins. The agent calls tools. It invokes APIs. It delegates to sub-agents. It mutates state. It sends messages. It may create external consequences.

In classical distributed systems, we have long known that long-lived transactions are hard. The Saga model frames a long-lived transaction as something that can be broken into sub-transactions while still being executed as a unit.

Agentic AI has the same problem, only harder.

The coordinator may be partly non-deterministic. The executor may be model-dependent. The next step may be context-sensitive.

So every sub-agent task, tool, or skill must declare its consequence semantics.

Can it be reversed? Can it be compensated?　Can it be forward-recovered?　Or is it irreversible?

Sending an internal draft may be reversible. Cancelling a booking may be compensatable. Repairing a workflow may be forward-recoverable. Disclosing confidential data may be irreversible.

You cannot govern a mission if you do not know which parts can still be unwound.

Agentic AI turns distributed transactions into distributed judgment.

And that judgment must be bounded, observable, and interruptible.

Metadata Advertisement Through Agent Cards

This brings us to Agent Cards.

It is a self-description of an agent’s name, provider, endpoint, capabilities, skills, authentication schemes, and interaction requirements, and maybe one day, express its transaction properties like whether it can be rewound.

They are important for discovery, capability declaration, endpoint discovery and protocol selection.

But we should be precise about what they do and do not solve.

An Agent Card may tell us what an agent claims to be able to do.
It does not, by itself, prove that the agent is authorized for this mission.

It does not prove the runtime is trustworthy.

It does not prove the model, prompt, memory, or policy version.

It does not prove the Ultimate-Bot-Owner.

And it does not prove that the relying party should trust this agent for this transaction.

A self-asserted Agent Card is not governance.

It is advertising.

Even a signed Agent Card only moves us one step forward. A signature tells us that a key signed something.

The verifier still has to decide whether the signer, the key, the issuer, and the trust framework are acceptable for this purpose.

So identification is not trust.

Discovery is not authority.

Metadata is not accountability.

The SPIFFE/SPIRE Pattern

A useful analogy comes from SPIFFE and SPIRE.

SPIFFE and SPIRE are not agent-governance standards. But they show a pattern we should learn from.

A workload should not simply announce who it is. It should receive an identity after attestation.

SPIRE performs node and workload attestation to securely issue SVIDs to workloads and verify SVIDs of other workloads. A SPIRE deployment has servers and agents; the server acts as a signing authority and maintains workload identity registrations and issuance conditions, while agents expose the Workload API locally.

This is powerful because the claim is grounded in a control plane.

But for agentic AI, workload identity is only the beginning.

Attestation can help answer: what is running?

It does not answer: whose mission is being executed? What authority was delegated? Which model or prompt was used? Which policy applied? Can the action be compensated? Who is the UBO?

So we need workload attestation plus mission attestation, authority evidence, transaction semantics, and oversight reporting.

Establishing a Trust Framework Through Federation

This brings us to Federation.

Agent Cards tell us what is claimed.

Attestation tells us something about what is running.

Federation helps us decide whose claims and attestations we should trust.

OpenID Federation defines how entities that want to interact can establish trust through a trusted third party called a Trust Anchor. It supports multiple levels of authority, and an entity may belong to more than one federation. It provides the technical trust-infrastructure building blocks for dynamic and distributed trust networks.

Federation helps us ask whether that signing key belongs to an entity in a trust framework we accept, whether there is a valid trust chain, whether metadata policy has been applied, and whether trust marks are meaningful to this relying party.

For agent governance, this is critical.

We do not want every party to manually decide whether every agent, provider, registry, attestation issuer, or UBO is acceptable.

We need trust chains and metadata policy.

We need a way to decide whose claims we accept before authority is exercised.

And there are many useful components already. From the OpenID Family of specs alone, we have these. (citing OpenID Connect, OpenID4VCI/VP, AuthZEN, OpenID Connect Authority claims extension, OpenID Shared Signals and Events Framework.)

Many of them are mathematically formally verified for their security.

We should reuse what we can and build what we really need.

Liability and Actuarial Challenges

Finally, we arrive at the question governance always reaches in the end.

Who owns the loss?

If an agent leaks data, misroutes a payment, manipulates a workflow, sends the wrong instruction, or triggers a harmful chain of actions, where does accountability finally rest?

That is why Ultimate-Bot-Owner matters.

And it is why evidence matters.

Without evidence, accountability is weak.

  • Liability is speculative.
  • Insurance is guesswork.
  • The actuarial basis for agentic AI risk is still immature.

That is not a reason to wait.

It is a reason to build the measurement infrastructure now.

Insurance is not built on slogans. It needs exposure, frequency, severity, control effectiveness, causality, and loss data.

Software is becoming staff.

We need governance.

There are standards that we can leverage.

But it is not enough to build a governable Agent Infrastructure. There are many gaps to be filled.

Fellow Identerati, we are only at the beginning of a journey to build a governable agentic AI ecosystem.

Let us collectively Start Building Now!

Slides (PDF)

When-Software-Becomes-Staff-07-2026-05-19

Related posts