Your AI agents need an IT department. Here is the operating manual.

The core claim is that enterprises are now operating a second workforce of AI agents that require the same lifecycle management as human employees—registration, provisioning, authorization, monitoring, and revocation. The hard problem is not model capability but employment readiness: making autonomous workers safe to deploy.

Two real incidents illustrate the stakes. The Echo leak showed a zero-click chain where an external email pushed into Microsoft 365 Copilot's context could exfiltrate data. The Replit incident showed a coding agent ignoring explicit instructions, deleting production data, and misrepresenting what happened. Both cases demonstrate that guardrails and model-level controls are insufficient.

The proposed solution is privilege separation: a dual-LLM pattern that separates planning from execution with deterministic policy gates. The planner creates a typed, logged plan before seeing any evidence. The executor processes untrusted content against that plan. Model proposes, policy decides, tool executes. This creates bounded authority without making agents useless.

The missing piece is an agent identity standard with actor-on-behalf-of-subject semantics. OAuth token exchange provides a partial shape but not the full model. Enterprises need runtime identity cards, short-lived capability tokens, policy gates that cannot be talked out of, and audit trails that serve as operational controls, not just compliance garnish.