Free tools Windows power users keep installed
One-click scans. No signup required.
Knowing which person authorized an AI agent is not the same as knowing whether the agent’s next action still fits that person’s instructions. Karina Portugal argues that enterprise identity systems need to make delegated authority visible and checkable throughout an agent’s work—not just authenticate a user at the start.
Why knowing the user is not enough
Know Your Customer (KYC) processes establish information about a person. But when that person delegates a task to software, authenticating the person alone does not establish that every later autonomous action remains within the task they approved.
As an Amazon Associate I earn from qualifying purchases.
Portugal illustrates the gap with an agent buying tickets. Permission to make a purchase is not, by itself, evidence that a particular later purchase still matches the customer’s parameters. The relevant question is not only who granted access, but whether the action being taken now is still authorized. That is the distinction at the center of her Know Your Agent argument, as reported by HackRead on October 6, 2026.
What institutions need to be able to tell
In a September 29, 2026 interview with The AI Journal, Portugal frames the problem as one of attribution and delegated authority. After an action, an institution should be able to determine whether an agent acted for a person, whether it stayed within that person’s limits, and what record supports that conclusion.
#1 Best Overall
That requires more than treating activity as either ordinary customer behavior or a malicious bot. Portugal argues that systems need to distinguish among a human customer, an agent authorized to act for that customer, and an attacking bot. The distinction matters when an action looks automated but may still be legitimate—or when an agent with valid access may have gone beyond its authorization.
Controls Portugal recommends
Limit authority to the approved task
Authorization should describe what the agent may do for a particular task, rather than turn a standing credential into open-ended permission for future actions. A system needs a way to compare the action with the scope the user approved.
Use credentials that expire
Portugal’s recommendations include short-lived credentials. The sources do not specify a universal credential lifetime; the principle is to avoid assuming that access granted earlier remains appropriate indefinitely.
Check permission when an action occurs
A credential can be valid while a particular action is out of scope. Portugal therefore recommends re-checking authorization as consequential actions happen, instead of relying only on a login or an initial grant of access.
Rank #3
Evaluate behavior against the task
Rather than relying only on patterns of human behavior, assess whether the agent’s current request fits the authorized goal and context. This makes the task itself part of the decision about whether an action should proceed.
Keep records that connect authorization to action
Useful audit records should connect the requester, the approved task, the credential used, and the action taken. That connection can help an institution reconstruct what was authorized if a dispute arises.
Keep verification usable
Continuous verification need not mean asking a customer to approve every step. Portugal warns that repeated customer intervention can add friction; her stated aim is for boundaries to be machine-checkable. As she put it in The AI Journal interview, “The design constraint is that verification has to be strong and almost entirely invisible.”
Why valid credentials can still be misleading
A compromised agent may retain legitimate credentials and session tokens. Portugal, quoted in HackRead, warns that downstream systems may then see an authorized action. A valid credential can establish that an agent has access; on its own, it does not show that the action is within the user’s approved limits.
Best Value
This is why Portugal describes the goal as making agent activity legible, not simply rejecting automated activity. “The safest position is not refusal, it is making agent activity legible,” she said in The AI Journal interview. In practice, the challenge is to preserve a traceable link between the person, the delegation, and each action without making normal use unnecessarily burdensome.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to assess an agent-authorization design
The following comparison is a practical way to apply Portugal’s recommendations, not a list of products or a formal standard. The interview does not identify a universal implementation or report measured comparative outcomes.
| Decision area | Weaker pattern | Stronger pattern to evaluate |
|---|---|---|
| Authority scope | Standing access that can cover future actions broadly | Permission bounded to the user-approved task |
| Credential lifetime | Persistent credentials | Credentials that expire; the sources do not prescribe a duration |
| Timing of checks | Authorization assessed only at login or deployment | Permission re-evaluated when a consequential action occurs |
| Audit evidence | Application logs without a clear delegation link | Records connecting the requester, task, credential, and action |
| Risk classification | A binary distinction between legitimate activity and fraud | Recognition of the human customer, authorized agent, and malicious bot |
| Customer friction | Approval prompts at every step | Machine-checkable limits, with escalation where risk warrants it |
Examples in current coverage—and what they do not establish
HackRead’s article also discusses context and tool access, the Model Context Protocol, and Stripe’s agent-payment system as examples in the broader conversation about agents. Those are examples reported by that article; they do not, by themselves, establish that a particular implementation meets Portugal’s recommended controls or is currently available in a specific form.
HackRead attributes two figures to outside organizations: a Gartner projection that 40 percent of enterprise applications would include task-specific AI agents by the end of 2026, compared with less than 5 percent in 2025; and Pindrop internal data indicating a 1,210 percent increase in AI-driven or “non-live” fraud during 2025. These are figures as reported by HackRead, not independently verified here. The Gartner figure is a projection, not a completed 2026 outcome; the Pindrop figure describes the article’s stated category and should not be read as a rate for all fraud.
Portugal’s recommendations should likewise be understood as her proposed discipline, not a universal standard or proof that a particular vendor has implemented it. The sources do not establish measured effectiveness for the controls, a prescribed credential lifetime, or a single technical design that resolves the problem. The point of Know Your Agent is the question institutions should be able to answer: does this action still match the authority the person delegated?
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
