AI agents: what evidence is needed before giving them permission to act?
TokenShift Executive Note
AI-translated from the original French version.
An agent can access an application without knowing its password and still have permissions that are too broad. Before authorising a task, an executive needs to know which operations the agent can perform, who will approve them and what the team will find if it interrupts the work.
Protecting credentials does not define permissions
Anthropic describes Claude Duet as an agent that can work in the background in connected applications. According to its documentation, as of 26 October 2026, the preview was available by waitlist to Pro and Max subscribers in the United States, excluding Team and Enterprise plans. The announcement therefore does not document any deployment in a regulated European company. Anthropic announcement; Claude Duet documentation.
1Password has announced a mechanism in which the user approves a sign-in request on their device, then the password manager fills in the form without passing the password to the agent. Its press release describes the Duet integration as still forthcoming. 1Password press release.
For calls between applications, WorkOS describes another mechanism: Relay adds the provider’s credential on the server side, outside the agent’s environment. Its documentation says a WorkOS key still needs protecting and that Relay is in early access. The TLDR item about Relay was sponsored; describing a mechanism is not independent evidence of its effectiveness. WorkOS documentation.
These mechanisms aim to keep login credentials separate from the agent. By themselves, they do not establish which operations an open session permits. That second question should guide the decision to delegate.
Start with the task to set permissions
Take a hypothetical example: a finance team wants the agent to prepare reminders for unpaid invoices, which a manager will review before any are sent. The agent needs the relevant invoices, their payment status and billing contact details. Preparing the reminders does not require permission to change a payee, grant a discount or write to the entire customer base.
The OWASP LLM06:2025 reference distinguishes, among other things, excessive available functions, permissions and autonomy. It recommends having the systems receiving the requests enforce authorisations, instead of relying on the model alone to follow an instruction. OWASP, LLM06:2025.
In this example, telling the agent to “never send” remains an instruction. Technically restricting its access to creating drafts limits what it can do. If the connector does not allow that restriction, the team can narrow the proposed scope, for example by preparing reminders from a controlled export and keeping sending within the usual process. The team must be able to show the permissions actually granted before broadening the task.
Make approval apply to the operation performed
Anthropic says Duet is designed to request approval before certain actions, including sending a message, making a payment, signing or deleting. The company also says its defences against malicious instructions in the content Duet reads are not perfect. These stated features still need to be tested against the intended task. Claude Duet documentation.
For the hypothetical reminders, a general request for “approval” would give the manager little to assess. They should be able to review the recipient, invoice, outstanding amount, text and attachments, then check them against the case file. If any of these elements changes after approval, fresh approval is needed so that the operation performed matches the one reviewed.
This review also affects the assessment of the benefit. Preparing more messages does not demonstrate a gain if every proposal requires the case file to be reconstructed. The time until a reminder is accepted, including corrections and review, along with errors in recipient, amount or status, would better inform the decision on whether to extend its use.
Check what remains after an interruption
According to Anthropic’s documentation, it is not yet possible to view Duet’s browser or take control of it. Disconnecting an application stops future access but does not erase information already exchanged from the agent’s memory. Cutting off access, resuming a task and handling retained data are therefore three distinct checks. Claude Duet documentation.
Before any expansion, the team should interrupt a representative task and establish what has been done, what remains pending and the state left in each application. For the hypothetical reminders, the manager would need to find the drafts, any messages already sent and the cases still to be processed. The records must connect the request, the approval and the operation performed without needlessly copying the entire case file.
The business owner must be able to assess the result; the technical team must be able to revoke access and provide those records. The cited announcements describe mechanisms, but they demonstrate neither the benefit of this delegation nor complete recovery after an interruption. If the effective permissions, the approved operation and the recoverable state cannot be established, the priority is to verify them before expanding access.