AI agents need verifiable limits on what they may do before institutions give them broader autonomy. In a 29 September 2026 interview with The AI Journal, Karina Portugal of Prove Identity argues that checking a person at login does not prove that an agent’s later actions remain authorized or reflect that person’s intent.
What breaks first when agents act for people?
Portugal’s concern is the gap between verifying a person and attributing a later action. Traditional identity checks can establish who a person is at a point in time. An agent may then act repeatedly, later, and without the person present. A successful initial check alone cannot show that each subsequent transaction was requested by the person or stayed within the authority they intended to delegate.
As an Amazon Associate I earn from qualifying purchases.
Her framing is that trust must persist through the activity, rather than being treated as a one-time event: “The industry spent years treating verification as an event. It has to be a state.” That is Portugal’s position in the interview, not a demonstrated industry-wide finding.
Why existing authorization may not answer every question
Portugal acknowledges that systems already support forms of delegated access. Her argument is that when commercial actions happen without a human present, institutions still need evidence about the particular delegation and what the agent did under it. After a disputed action, she says, the relevant questions include:
#1 Best Overall
- Did the agent genuinely act for the person?
- Did it stay within the limits the person set?
- Were those limits recorded in a way neither side could rewrite afterward?
She proposes task-scoped authority, short-lived credentials, contextual information at the protocol level, and checks at each relevant layer and action. These are recommendations from the interview; it does not assess specific authorization standards or establish that current systems universally lack these capabilities.
What a trust layer would need to make visible
In Portugal’s view, institutions should be able to tell apart a customer acting directly, an authorized agent acting for that customer, and a malicious bot targeting an account. She warns that simply refusing agent activity could encourage it to appear as ordinary browser traffic, making it harder for institutions to see what is happening. The interview gives no measured evidence about how often this occurs or what outcomes it causes.
Her proposed “Know Your Agent” approach would make agent activity a distinct risk category rather than forcing it into a human-versus-malicious classification. That distinction matters because compliant agents may move quickly and consistently, without the pauses, typing errors, or other patterns a system calibrated for people expects. A human-oriented model could therefore interpret legitimate automation as anomalous.
How risk teams can assess actions, not just credentials
A credential can remain valid even after an agent is compromised or starts acting outside its assigned task. Portugal’s recommendation is to assess whether behavior still fits the authorized task, not to treat credential validity as proof that every action is appropriate. In practical terms, this means a risk process needs to relate observed actions to the scope and purpose of the delegation, as well as establish whether the authority is still current.
She also discusses one-time passcodes (OTPs). In her account, an OTP shows that a code reached a destination, but does not by itself establish that the number belongs to the person using it. She cites SIM swapping, number porting, and social engineering as possible weaknesses, and points to number tenure, recent changes, device possession, and whether the device is expected as signals a team might consider. These are Portugal’s interview claims, not a complete comparison of authentication methods.
What institutions can do now
Portugal names three near-term steps. They do not depend on waiting for a formal standard:
Rank #4
- Define authority in writing. Decide what an agent may do on a customer’s behalf before product teams make that choice implicitly through implementation.
- Retain delegation evidence. Keep records of what was authorized in a form that could be presented to a regulator or court.
- Distinguish agent traffic. Start collecting data that separates human activity from agent activity, so later risk models can use that distinction.
As Portugal puts it, “Three things, and none of them require waiting for a standard. Decide internally what an agent is allowed to do on a customer’s behalf, in writing, before a product team decides it for you.” Her reason for starting data collection early is that a future model cannot learn from a distinction an institution never captured.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to balance stronger checks with usability
Portugal does not argue for asking a customer to approve every agent action. Repeated prompts could add friction and undermine the usefulness of delegation. Instead, she favors making the limits machine-checkable so a system can verify actions without requiring constant human intervention: “The point is not to put a human back in the loop at every step. It is to make the limits machine-checkable so you do not need to.”
Best Value
She predicts practical conventions may develop through institutions and infrastructure providers before formal standards emerge. That is a forecast, not an established schedule. Her design goal is strong verification with little or no repeated customer involvement.
What the interview establishes—and what it does not
The interview records Portugal’s recommendations and describes her as Prove Identity’s Director of Banking, Marketplaces, Strategic Partnerships and Agentic Trust, working with banks, fintechs, and marketplaces in the United States, Brazil, and Latin America. It does not provide measured adoption, fraud rates, or test results showing that a particular trust architecture reduces risk.
In a related 7 July 2026 article, Portugal outlines four implementation layers: scoped, short-lived credentials; context and tool access; continuous behavioral verification; and audit records linking actions to authorization. She characterizes MCP as a communication layer rather than a permission system and recommends evaluating tool calls against scoped credentials. These are her technical commentary, not independently validated findings in the interview.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
