What follows is an AI-generated, readable text version of the keynote speech I delivered at EIC 2026. The speech is available at KuppingerColes Site. The link to the speech transcript and slides is here.
Software as staff
For decades, software has executed commands: processing forms, moving records, calculating results, enforcing workflows, and connecting systems. It is now beginning to act more like staff. These are not human staff, legal persons, or colleagues in the human sense, but digital actors to which we give missions, access, and tools. We expect them to coordinate, decide, escalate, delegate, and produce outcomes in the real world.
Traditional applications usually operate within a defined interface. They receive an instruction, execute a function, and return a result. An agent may instead receive a broad objective and decide how to pursue it. It may select tools, invoke APIs, create subtasks, coordinate with other agents, adapt to context, and act across organizational boundaries. The phrase “digital staff” describes this way of using software: we assign work, grant permissions, expect outcomes, and ultimately need someone to take responsibility for what it does.
This changes the governance problem. Model accuracy and secure API access remain important. Still, we must also ask who authorized the work, whose intent is being served, what authority was delegated, what changed during execution, who can stop it, and who is accountable when consequences arise. Agentic AI is a delegated-authority problem, with questions of identity, ownership, control, evidence, liability, and trust alongside those of model safety and application security. When software becomes staff, identity becomes governance.
Identity and accountable ownership
Emerging agent-to-agent systems already allow a remote agent to advertise what it can do, where it can be reached, which skills it has, and what authentication it requires. Such discovery is useful. Once collaboration crosses an authority boundary, however, the relying party must know more than the endpoint. If an agent can act, delegate, and create consequences, the relying party needs to know who stands behind it.
First, we must establish what makes an agent the same agent over time. Human identity has continuity: a person can learn, change roles, and gain experience while remaining the same person for accountability purposes. With an AI agent, continuity is less obvious. A model or system prompt may change. Memory may be reset, merged, or shared. The toolchain, runtime, or provider policy may change; a sub-agent may be substituted; or a mission may move from one executor to another. After such changes, what exactly are we trusting, and who is the owner responsible for its actions?
Every agent acting with authority needs an accountable owner. I call this the Ultimate-Bot-Owner, or UBO. The phrase is deliberate: accountability cannot stop at a shell entity. We must identify the UBO before commissioning work. Otherwise, the agentic network we deploy faces unacceptable risk. Establishing ownership is part of containing supply chain risk.
Distinguishing the mission from the prompt and session
Ownership tells us who is accountable. The mission defines the governed delegation of intent under which an agent acts. It includes the goal, constraints, authority, resources, duration, applicable policy, evidence requirements, and accountability context for one or more agents.
A mission must be distinguished from both a prompt and a session. A prompt is an instruction. A session is where the agent can continue working. The mission is why the agent is allowed to keep working. These concepts are orthogonal and must not be conflated.
A mission may outlive an agent, or it may end before the agent goes away. A session may continue after its mission has terminated, in which case terminating the session as well may be appropriate. Both the agent’s actions and its session are constrained by the mission: they must serve only its fulfillment.
The mission must therefore be bounded, reviewable, capable of suspension, and accompanied by evidence. Without these properties, agentic systems will move authority around without a reliable record of where it came from.
Human authorization at scale
A human gives agents a mission, and the agents autonomously form tasks and decide on actions. Because agents generally cannot themselves bear accountability, they often need a human in the loop to authorize those actions. Human judgment may be essential for high-impact actions, legal actions, regulated decisions, financial transfers, external communications, and irreversible disclosures.
The difficulty is scale. A worker may have tens or hundreds of agents, and an organization may have thousands. A human cannot meaningfully approve every step, so oversight cannot consist solely of human review.
Nor does the presence of a human automatically make governance meaningful. A person under time pressure who sees a compressed approval request, has incomplete information, and nevertheless presses OK is not making a real decision. That is automation bias with a human signature attached.
We need help from an oversight agent on the principal’s side. It should evaluate evidence and risk signals, filter what needs attention, and escalate to the principal with relevant information when necessary. Its position matters: it should serve the person or organization that originally delegated the task and remain loyal to that principal, rather than to the system trying to complete the work.
Missions as distributed transactions
To understand what effective oversight must be able to do, we also need to understand the consequences of the work it supervises. An agentic system is a distributed object system and a distributed transaction system. During a mission, agents call tools, invoke APIs, delegate to sub-agents, mutate state, send messages, and potentially create external consequences.
Classical distributed systems have long faced the difficulty of long-lived transactions. The Saga model treats a long-lived transaction as something that can be broken into subtransactions while still being executed as a unit. Agentic AI has the same problem, made harder by a coordinator that may be partly non-deterministic, an executor whose behaviour may depend on its model, and a next step that may depend on context.
Every sub-agent task, tool, or skill must declare its consequence semantics. Can an action be reversed, compensated, or forward-recovered, or is it irreversible? Sending an internal draft may be reversible; cancelling a booking may be compensatable; repairing a workflow may be forward-recoverable; and disclosing confidential data may be irreversible.
We cannot govern a mission without knowing which parts can still be unwound. Agentic AI turns distributed transactions into distributed judgment, and that judgment must be bounded, observable, and interruptible.
Reporting and intervention
The oversight agent needs structured reports from the acting agent when it forms an intent, when it executes an action, and when exceptions, changes, or results arise. Shared Signals-style eventing can form part of this reporting system, but we still lack a concrete standard for implementing such structured reporting.
Signals are also distinct from a kill switch. They belong to the signalling layer; governance needs a control plane that can intervene. That control plane must be able to pause a mission, restrict authority, turn off a tool, block delegation, revoke credentials, quarantine memory, escalate to a human, or terminate the mission. We also lack a standard protocol for these interventions.
What Agent Cards establish
Agent Cards provide an agent’s self-description: its name, provider, endpoint, capabilities, skills, authentication schemes, and interaction requirements. They may one day also express transaction properties, such as whether an action can be unwound. They are important for discovery, capability declaration, endpoint discovery, and protocol selection.
These functions have limits. An Agent Card may describe what an agent claims to be able to do, but it does not by itself prove authorization for a particular mission, the trustworthiness of the runtime, the model, prompt, memory, or policy version, or the identity of the UBO. Nor does it establish that a relying party should trust the agent for this transaction.
A self-asserted Agent Card is advertising rather than governance. Even a signed card advances us only one step: the signature tells us that a key signed something. The verifier must still decide whether the signer, key, issuer, and trust framework are acceptable for the purpose at hand. Identification does not establish trust, discovery does not confer authority, and metadata does not establish accountability.
Attestation and the limits of workload identity
SPIFFE and SPIRE offer a useful pattern to learn from, although they are not agent-governance standards. A workload should receive an identity after attestation instead of simply announcing who it is.
SPIRE performs node and workload attestation to issue SVIDs securely to workloads and verify the SVIDs of other workloads. A SPIRE deployment has servers and agents. The server acts as a signing authority and maintains workload identity registrations and issuance conditions, while agents expose the Workload API locally. The identity claim is therefore grounded in a control plane.
For agentic AI, workload identity is only the beginning. Attestation can help establish what is running, but it does not establish whose mission is being executed, what authority was delegated, which model or prompt was used, which policy applied, whether the action can be compensated, or who the UBO is. We need workload attestation together with mission attestation, authority evidence, transaction semantics, and oversight reporting.
Federation and the acceptance of claims
Agent Cards describe what is claimed, and attestation tells us something about what is running. Federation helps us decide whose claims and attestations to trust.
OpenID Federation defines how entities that want to interact can establish trust through a trusted third party called a Trust Anchor. It supports multiple levels of authority and allows an entity to belong to more than one federation, providing technical building blocks for dynamic, distributed trust networks.
Federation helps a relying party determine whether a signing key belongs to an entity in an accepted trust framework, whether a valid trust chain exists, whether metadata policy has been applied, and whether trust marks are meaningful to that relying party. These questions are critical to agent governance. We cannot expect every party to decide manually whether every agent, provider, registry, attestation issuer, or UBO is acceptable. We need trust chains and metadata policy so that we can decide whose claims to accept before authority is exercised.
There are already many useful components in the OpenID family of specifications, many of which have been formally verified for security using mathematical methods. We should reuse what we can and build what we really need.
Evidence for accountability and insurance
Governance ultimately reaches the question of who owns the loss. If an agent leaks data, misroutes a payment, manipulates a workflow, sends the wrong instruction, or triggers a harmful chain of actions, where does accountability rest? This is why both the Ultimate-Bot-Owner and evidence matter. Without evidence, accountability is weak, liability is speculative, and insurance is guesswork.
The actuarial basis for agentic AI risk remains immature. This is a reason to build measurement infrastructure now, rather than wait. Insurance requires exposure, frequency, severity, control effectiveness, causality, and loss data.
Software is becoming staff, and it needs governance. Existing standards give us components to reuse, but they are not yet sufficient to build a governable agent infrastructure. Many gaps remain. The identity community is at the beginning of the work needed to create a governable agentic AI ecosystem. We should undertake that work collectively and start building now.
(Created using ChatGPT from the speech transcript below. )
Speech Transcript and slides
You can find them here.