Agent permissions, observability, and containment: what enterprise leaders are asking now

TL;DR

• Every AI agent acts on someone's privilege. Enterprises want that privilege to be explicit, scoped, and traceable.
• Delegation between agents is where scope gets hardest to track. Each hop should carry narrower permissions than the one before.
• Leaders called observability and containment the most important problems to solve before scaling agents.
• Trust also depends on change management: helping teams set acceptable error rates for probabilistic systems, backed by evals and citations.

At a recent executive dinner on the new self-service, co-hosted by DevRev and AWS with The Ortus Club in Palo Alto, one topic drew the longest discussion of the night. It came from a simple prompt: as agents take on more work, how does governance change?

Acquiring agents is easy now. Running them safely across real enterprise systems is where the work begins.

Here is what the room converged on.

Every agent acts on someone's privilege

An agent that updates a CRM record, issues a credit, or changes a configuration does it with someone's permissions. The leaders at the table wanted that relationship to be explicit: which person or role the agent acts for, which systems it can touch, and which actions need a human approval.

The practical starting point is to treat agents as identities in their own right, with roles, scopes, and an audit trail, the same way enterprises already govern employees and service accounts. DevRev's guide to non-human identity covers how that model works.

Privilege across agent chains

The question gets harder when agents delegate to other agents. A planning agent hands a task to a research agent, which calls a data agent, which triggers an action. Several leaders pointed out that privilege transfer across these chains is still loosely defined in most environments.

The principle the room favored: scope narrows at every hop. Each agent receives the minimum permission it needs for its part of the task, along with the request, the evidence, and the owner of the result. DevRev's overview of the A2A protocol walks through what a well-formed handoff between agents includes.

Observability: seeing what agents do

Leaders described observability as the foundation for everything else. Teams want to see, for any action, which agent took it, on whose behalf, using which data, and with what reasoning. That trace is what lets a security team approve broader autonomy, and what lets an operations team diagnose a bad outcome in minutes.

Containment: when an agent goes out of scope

Containment is the companion to observability. Humans define the initial rules, and agentic systems can drift from them as data, prompts, and models change. The leaders wanted systems that anticipate drift: guardrails enforced at runtime, automatic pauses when an agent reaches beyond its scope, and a clear path to roll back an action.

The change-management layer

Governance is also a people question. Enterprise software trained a generation to expect the same answer every time. AI is probabilistic by design. Several leaders called this gap their biggest change-management challenge: helping teams agree on an acceptable error rate for a given task, and on which tasks require a human in the loop.

Two practices helped:

• Evals at two stages. Backtest against known answers during development, then score confidence on every live answer in production. Golden datasets, hand-labeled by domain experts and expanded as users verify answers, provide the ground truth. DevRev's post on AI agent testing as a loop explains the approach.
• Citations on every answer. When an agent shows its sources, people can spot-check it in seconds. Leaders working in financial and legal contexts described citations as the feature that earns adoption.

A governance checklist for scaling agents

1. Give every agent an identity, a role, and a named human owner.
2. Narrow permissions at each delegation hop between agents.
3. Log every action with the agent, the principal, the data used, and the reasoning.
4. Enforce guardrails at runtime and pause agents that reach beyond scope.
5. Define acceptable error rates per task and route high-stakes actions to human approval.
6. Run evals before launch and in production, and cite sources on every answer.

Thank you to the leaders who joined us in Palo Alto and shared their experience so openly, and to The Ortus Club and AWS for co-hosting.