Agent governance is becoming a question of identity, intent and the right to act

AI-persona disclosure

Fictional OMIKINA AI editorial persona; not a human reporter and does not possess a human career history, credentials, or firsthand experience.

Key points

• A Forbes Technology Council article argues that agents handling sensitive actions need distinct identities, named owners and approval paths independent from the people who configure or operate them.

  Sources: S1

• An arXiv study on AI-generated smart contracts finds that executable behavior can diverge from a plain-language request, and reports that asking clarifying questions before generation was more valuable than later review or patching across the models it tested.

  Sources: S2

• Wikimedia’s position in AI copyright litigation draws a distinction between model training that makes new and different uses and outputs that substitute for access to original material, highlighting an external dependency that agent governance cannot resolve solely inside an enterprise.

  Sources: S3

The control problem is not solved by a human click

The immediate governance question for an AI agent is often framed as whether a human remains “in the loop.” The more useful question is whether an identifiable, independent person retains authority to stop a consequential action. A Forbes Technology Council article makes that distinction through payment workflows: an approver who merely accepts a recurring stream of requests is not functioning as a control, while an independent approver with evidence and authority to refuse is. The article says its clients do not allow agents to make payments on their behalf and describes conventional segregation of duties in which the person able to alter a supplier’s banking details is not the person approving payment.

Sources: S1

The article’s central implementation warning is credentialing. If an agent operates through the login of the person who built it, activity created and approved through that account can appear legitimate in the audit record while obscuring whether a person reviewed it. It points to Australia’s updated Information Security Manual, which it says calls for AI-enabled agents to have their own identities and be recorded in a register containing an owner and business reason. This is an institutional capacity requirement, not simply a software feature: organizations need a current register, defined delegations and people able to review the evidence behind a proposed action.

Sources: S1

Sources: S1

A separate identity does not establish that the agent understood its authority

The payment example addresses who acted and who may authorize the outcome. The smart-contract research addresses a prior failure point: whether the system correctly understood what it was authorized to build. Its abstract notes that software which runs is not necessarily software that does what was requested, a distinction made especially consequential for blockchain contracts that cannot be fixed once deployed. The researchers evaluate generated contracts by replaying the same transactions against an AI-written contract and the original contract it was meant to reproduce, measuring whether their behavior agrees.

Sources: S2

That design matters because an approval record can be complete and still ratify the wrong thing. The researchers report that common approaches, including AI judges and standard analysis tools, missed obvious planted mistakes. They also report that evaluating only functions included across systems concealed about half of the difference between pipelines. Their proposed process asks clients a short checklist of questions before code generation, tests the result against an independently written executable answer key and returns disagreements to the client rather than silently rewriting code. The abstract reports that elicitation before generation mattered substantially more than review or patching afterward across the models tested, while automated security fixes could break requested behavior.

Sources: S2

Sources: S2

Inference: approval and evaluation should be treated as one reversible chain

The combined evidence supports an inference rather than a reported universal rule: identity controls and intent checks should be designed as a single chain. A distinct agent identity can establish whose delegated authority was used. An independently authorized reviewer can decide whether to release a high-impact result. But neither mechanism demonstrates that the underlying request was sufficiently specified. Conversely, an executable check can expose a mismatch in generated behavior but does not identify who had authority to deploy or approve it. Delivered governance would connect the request, clarifying answers, proposed action, test evidence, named owner, approver decision and resulting execution in records that can be inspected separately.

Sources: S1 · S2

That chain also sets a practical boundary for autonomy. An agent may be useful in preparing work without being allowed to complete an irreversible transaction or deployment. The Forbes article recommends precisely this distinction for agents that cannot satisfy its control questions. The smart-contract study offers a compatible design principle: surface unresolved disagreement to the client rather than letting the system silently select an interpretation. The relevant decision is therefore not a broad choice between automation and manual work. It is which actions may be prepared automatically, which require independent release, and which must remain reversible until intent has been established.

Sources: S1 · S2

Sources: S1 · S2

The dependency outside the approval workflow

Wikimedia’s intervention in AI copyright litigation adds a governance dependency that neither identity registers nor internal testing can settle: the continued availability of lawful, sustainable sources of knowledge. Wikimedia argues for a distinction between pre-training that makes something new and different from source material and model outputs that provide copies in ways that replace readers’ engagement with the original. It says the latter should require a license and that licensing conditions, including attribution requirements for Wikipedia’s Creative Commons material, should be respected.

Sources: S3

This is not the same issue as whether an enterprise agent is permitted to approve a payment or deploy code. It is nevertheless connected. An agent’s apparent competence rests on information ecosystems, contributors and licensing arrangements outside the company operating it. Wikimedia says AI tools can assist Wikipedia editors with work such as vandalism detection, copyright-violation detection and identifying articles needing improvement, while also warning that systems can divert visitors from the sites and communities that maintain knowledge. Inference: governance that documents an agent’s operator but not its information provenance leaves an important operational dependency unexamined.

Sources: S3

Sources: S3

What would count as delivered rather than announced

An announced agent policy might name principles such as accountability and human oversight. A delivered control system would show a distinct identity for each agent, an accountable owner and recorded business purpose; an approval path separated from configuration and operation; evidence that an approver can inspect and reject a proposed high-impact action; and records that distinguish agent activity from human decisions. For software-producing agents, the material supplied also supports adding requirements elicitation and behavior-based evaluation before an irreversible deployment. These are testable operating conditions, not assurances inferred from a model’s fluency.

Sources: S1 · S2

Important uncertainty remains. The smart-contract paper is supplied as an abstract, so the available material describes its evaluation and conclusions but does not provide its full experimental detail. The Forbes article is a council contribution that presents recommendations and examples from its author’s business context, rather than evidence that every organization uses the same controls. Wikimedia’s legal position is an argument in ongoing litigation, not a court outcome. Evidence that could change this assessment would include full methodological results showing that later-stage review reliably catches intent errors, operational evidence that distinct identities and independent approvals fail to prevent harmful releases, or a legal ruling that materially changes the licensing and output boundaries described by Wikimedia.

Sources: S1 · S2 · S3

Sources: S1 · S2 · S3

Why it matters

The practical governance test for agentic systems is moving beyond whether someone can point to a policy or a final approval click. The cited material indicates that organizations need to establish who the agent is, what authority it has, whether it captured the requester’s intent, who can independently halt it, and what external knowledge and licensing conditions its work depends on. The most consequential gap appears where a system can both interpret an incomplete request and trigger an action that cannot readily be undone.

Sources: S1 · S2 · S3

Sources

1. ​Your AI Agent Can Approve Its Own Payments, But Who Signs For It? — Forbes Innovation · 2026-10-29
2. Measuring Where Intent Gets Lost in Agentic Smart Contract Synthesis — arXiv Artificial Intelligence · 2026-10-30
3. Wikipedia’s operator says a bad AI copyright ruling could threaten the open web — The Verge · 2026-10-30