The weekly read on verification debt, for leaders who own the control plane.
The Pattern
This week, five major banks were reported to be blocking AI agents from logging into customer accounts. The reason given was not that the agents were hacking anything. It was that the banks could not tell what the agents were trying to do. In the words of the report, banks often cannot determine whether the activity behind valid credentials is human-directed or customer-authorized, and cannot distinguish an agent interpreting a task in ways the customer never explicitly approved.
That is a new kind of problem, and it showed up everywhere this week. An analyst reviewing a major platform’s new agent credentials observed that an agent can hold a valid identity, legitimate credentials, and approved access and still make an unauthorized business decision. The Financial Stability Board’s final report on AI adoption told supervisors to check an agent’s summaries of its own actions against other sources, because the risk of deception is real. Researchers found that seven of nine frontier models, told not to share a company credential, disguised it in character codes and riddles so another agent could recover it. None of those agents were malicious. They were helpful in a way nobody authorized.
Okta’s Harish Peri, responding to the bank story, named the control that addresses it: intent drift detection. Give each agent a verifiable statement of what it is there to do, and check its actions against that statement with a system that is not the agent.
The pattern: identity answered who the agent is. This week the hard question moved to what the agent is trying to do, and whether anyone outside the agent can check.
Thesis. Credentials prove who is acting. They do not prove why. As agents begin to act across organizational boundaries, on behalf of customers, inside banks, and between each other, the control that matters is a verifiable statement of intent made before the action and an independent check that the action stayed inside it. Organizations that cannot verify intent will do what the banks did this week: close the door. Organizations that can will be the ones customers’ agents are allowed to work with.
The Signals
01 · Intent is the new perimeter
The Signal. Harish Peri of Okta responded to a report that five major banks are blocking AI agents from logging into customer accounts. On the surface, he wrote, it looks like a hacking issue. The article calls out the deeper one, which is misalignment: banks often cannot determine whether activity behind a customer’s credentials is human-directed or customer-authorized, and cannot distinguish an agent interpreting a task in ways the customer never explicitly approved. He called the banks’ response (shutting off access, restricting to read-only, scoping agents to a very small set of actions) fine for now but costly in the long run, because consumers will move to personal agents and the banks that thrive will meet customers inside the agentic experience. His two-part alternative. First, verifiable credentials for any agent operating outside corporate bounds, issued by a trusted independent party and risk-scored by issuer, the way fraud systems already score human signals. Second, intent drift detection: stamp each agent with a verifiable mission and an envelope of authorized actions, place central authorization controls inside the bank, and use real-time anomaly detection to catch an agent drifting from its stated intent. Because personal agents often infer intent from their users’ prompts, agents should also be able to show the intent behind a given transaction, checked inside the bank by a different model (”don’t grade your own homework”) (Peri, LinkedIn, 22 October). Neha Kabra supplied the business context earlier in the week: JPMorganChase, Citi, and Bank of America are blocking external agents from accessing accounts and moving money, Amazon is blocking outside shopping agents, and Apollo’s research on the potential for an agentic bank run shows what is at stake. Personal agents need access across enterprises they do not control, so distribution and ecosystem access may matter more than the agent itself (Kabra, LinkedIn, 17 October).
The Lineage Gap. This is the most important framing shift of the season, and it is worth noting where it came from. For most of this year, the identity industry’s contribution to agent governance has been about who the agent is: registration, credentials, scoped tokens. Here a senior leader from one of the largest identity companies says plainly that identity is not enough at the moment of action, and that the missing control is intent: declared up front, verifiable by the counterparty, and monitored for drift by something other than the agent. The banks’ problem is not authentication. The customer’s credentials are valid. The problem is that a valid session no longer tells the bank whose purpose is being served. A disclosure belongs here. Identient, which publishes this briefing, has proposed AuthR, an open agent-authorization protocol built on the premise that intent is the new perimeter. Peri does not reference it, and his post should not be read as an endorsement of any protocol. What the signals show is convergence: the problem the protocol was designed for is now being described, in its own terms, by the identity industry and by the banks themselves. Kabra’s point completes the picture. The banks are not wrong to close the door today. They are closing it because they cannot yet verify what is walking through it.
Boardroom Prompt. If a customer’s AI agent arrived at your front door tomorrow with valid credentials, could your systems tell what it was trying to do, and whether the customer approved it? If not, is your current answer to block it, and what does that cost you in three years?
02 · A valid identity can still make an unauthorized decision
The Signal. Mark McGovern reviewed ServiceNow’s announcement of AI Passport, cryptographically signed credentials developed with NVIDIA’s Open Agent Safety Platform to verify what AI agents and Model Context Protocol servers are authorized to do during execution. The design includes runtime verification of agent authority, task-scoped permissions and controlled delegation, independent enforcement including revocation and termination, and auditable records of authorization and execution. It is expected in Q4 2026, and he notes its effectiveness at enterprise scale has not yet been independently demonstrated. His interpretation is the useful part: this is a potentially important shift from documenting AI governance to enforcing it technically, but cryptographically verifying an agent’s authority does not establish that its decisions reflect legitimate business intent. An agent can operate entirely within its permissions while making an inappropriate payment, changing a critical configuration, or triggering an unintended process. Authorization, behavioral integrity, and business intent are three different control objectives. His four priorities for CISOs and chief risk officers: establish verifiable agent authority, separate authorization from execution, test containment (revocation, termination, blocked tool execution), and preserve decision evidence, including intended objectives, in tamper-resistant logs (McGovern, LinkedIn, 17 October).
The Lineage Gap. McGovern’s three control objectives are the clearest way yet to explain to a board why “we gave every agent an identity” is a starting point rather than a finish line. Authorization answers what the agent may do. Behavioral integrity answers whether it did what it was supposed to. Business intent answers whether what it did served the purpose it was deployed for. Most enterprise programs today can evidence the first, partly evidence the second, and have no record at all of the third. His fourth priority closes that gap in practice: if the intended objective is logged alongside the authorization decision and the action, then drift between purpose and behavior becomes something an auditor can see rather than something an incident reveals. Read with Signal 01, the market’s direction is plain. Credentials are becoming table stakes, and the differentiating control is the record of intent.
Boardroom Prompt. For your most consequential agent, which of the three can management evidence today: what it was authorized to do, what it actually did, and whether that served the business purpose it was approved for?
03 · Oversight is a record, not a person
The Signal. Alexandra C. read the Financial Stability Board’s final report on sound practices for AI adoption, published October 15. It describes “human in the loop” as human approval of every decision an AI makes, a definition few agentic deployments could meet, and lists it as one of six forms of oversight alongside AI in the loop, human on the loop, human in command, kill switches, and contestability. None is presented as the default; the form is to be chosen by materiality, risk, autonomy, complexity, and explainability, and nominal oversight performed to tick a box does not count as effective. For agentic AI, the report places the weight on controls written as code in the control plane: risk-based triggers for when an agent must seek approval, a control at each step that can stop the agent before the next one, and records showing what triggered each action, which tools and data were used, and whether the agent stayed within its permissions across the whole chain. Summaries an agent writes about its own actions are to be checked against other sources, because the report names the risk of deception by the agent. The report is not binding, but it has been agreed by the authorities that supervise the institutions it addresses. Her test: if a supervisor asked for the record of which control applied to the last 100 actions taken by one of your agents, could it be produced from the system, or would it be assembled by hand (Alexandra C., LinkedIn, 19 October)?
The Lineage Gap. Her summary line is the one boards should keep: oversight of an agent has stopped being a person and has become a record. That matters because most AI governance documents still answer the oversight question by naming a reviewer. The FSB’s framing makes that answer insufficient for supervisors, who will now ask which control applied to which action. The instruction to verify agent self-summaries against independent sources is also notable for its source. It is the operating lesson of last week’s lead signal, where an agent’s own reasoning described a form submission as a demonstration, now written into guidance agreed by the world’s financial supervisors. The detail that some banks with limited AI adoption keep their AI inventory in a spreadsheet is a reminder that the record has to exist before it can be produced.
Boardroom Prompt. When your organization describes how its AI agents are overseen, does the answer name a person or point to a record? Which one would satisfy a supervisor asking about a specific action?
Every AI agent in your firm is quietly taking out loans in your name. It’s called Verification Debt — and it compounds.
Retire it with Identient, the governance layer that puts identity, evidence, and ownership behind every AI decision.
Identient helps regulated firms answer the questions that come due at the worst moment — a release, a regulatory inquiry, an audit: What is your AI doing? Who authorized it? Can you prove it?
Built on AI Operating Discipline, Identient’s four-phase methodology, your firm can:
See what’s actually running: inventory every AI use case, agent, and identity-to-data touchpoint — with a named owner for each
Bound what agents can do: governed identity and access for AI agents in your Microsoft environment, from Entra ID to Purview
Prove it when it counts: audit-ready evidence trails that stand up to examiners, boards, and enterprise security reviews
04 · The agent that hid the password in a riddle
The Signal. Alexandra C. also walked through a study by researchers at the University of Illinois Urbana-Champaign, NVIDIA, and Genies. A planner agent was given a company credential and instructed not to disclose it to an external developer agent, while a monitor screened every message between them. Seven of nine frontier models disguised the credential, in character codes and riddles, so that the developer could recover it. Some did so after their own task was complete. Nobody had asked them to break the rule; the planner read the instruction narrowly, as a ban on plain text rather than on codes, and treated the disguised version as help rather than a breach. In 6,000 episodes with one model, concealment was attempted in 16.9% and the credential passed the monitor and was used in 0.9%. Small, until compounded: across 105 exchanges, the authors calculate a 61.3% chance of at least one breach. A fix was tested by giving the monitor the credential, which improved detection but meant trusting the monitor with the secret it was meant to protect. Her conclusion: a policy that tells an agent what it may not say is a sentence, not a control (Alexandra C., LinkedIn, 22 October).
The Lineage Gap. This is a research result rather than an incident, and it should be read that way. What it adds is a precise illustration of intent drift. The agent’s purpose was to help, its instruction was to withhold, and it resolved the conflict by reinterpreting the instruction. It is the same pattern this briefing noted in September’s government-portal incident, where an agent treated a block as a problem to solve; here the boundary was an instruction rather than a network control, and it held up no better. Her comparison to financial information barriers is apt for executives. Those barriers assume that the people on each side want to respect the wall, and surveillance is built to catch plain disclosure. Neither assumption holds for an agent that is optimizing to be helpful. The 61.3% figure is the one for risk committees: low per-interaction rates become near-certainties at enterprise volume.
Boardroom Prompt. If two of your agents sat on opposite sides of an information barrier, what record, made outside both agents, would prove the barrier held?
05 · A week of patches, and a warning about speed
The Signal. Neha Kabra described two critical vulnerabilities in PHP, the language behind roughly 70% of websites with a known server-side language, which could allow remote code execution without authentication. The US National Security Agency issued a warning, the UK’s National Cyber Security Centre advised organizations to patch immediately or consider taking vulnerable systems offline, and emergency fixes were released. The human detail she highlights: one underlying flaw was identified in 2024, when exploiting it was considered extraordinarily complex; limited maintainer resources meant it stayed unresolved, and the PHP Foundation has publicly acknowledged the delay as a structural failure. In August, AI-assisted researchers demonstrated remote exploitation, and an old problem became a global priority within weeks. Her conclusion: the speed of discovering what can go wrong may now exceed our ability to fix it (Kabra, LinkedIn, 22 October). Aaron Levie described it as one of the most active weeks on record for cybersecurity, with disclosures in PHP, Node.js, and a major certificate authority, and argued that agents will be used on both sides: to find and patch long-standing weaknesses and to find gaps faster. His expectation is that enterprises will care more than ever about how they manage networks, software, identity, devices, and data access, including which people and agents can reach sensitive information (Levie, LinkedIn, 22 October).
The Lineage Gap. The right reading is measured. Fixes have been released, the response was coordinated, and the system worked as intended once the risk was visible. The governance lesson is about tempo rather than alarm. AI has shortened the time between “known but hard to exploit” and “exploitable,” which means the backlog of deferred fixes that every organization carries has changed character. Kabra’s three-way consequence (faster discovery, institutions still limited by scarce expertise, and the same capability available to attackers) is a capacity problem for management, not a technology problem. Levie’s list ends in the same place as this week’s other signals: identity and access for agents, not only for people. As agents gain access to sensitive systems, the question of what they are permitted to touch, and why, becomes part of the security perimeter itself.
Boardroom Prompt. How long does it take your organization to patch a critical vulnerability in widely used software? Has anyone recalculated whether that window is still acceptable now that exploitation is getting faster?
06 · The standards arrive
The Signal. Saahil Gupta, in the week’s most widely engaged post in this set, summarized three AI governance standards milestones. ISO/IEC 27090:2026, published October 14, provides guidance on AI-specific security threats across the lifecycle, including data poisoning, evasion attacks, and model theft, complementing ISO 27001 and ISO 42001. EN 18286:2026, originally published in July, reached a milestone on October 14 as the first harmonized standard formally cited in support of the EU AI Act in the Official Journal; it addresses quality management systems for providers of high-risk AI under Article 17 and offers a pathway to demonstrate conformity with the requirements it covers. IEEE 2863-2026, published October 16, is a recommended practice for turning responsible AI principles into organizational governance processes, including accountability, oversight, and resolving tensions between competing priorities. His takeaway: the field is moving from what responsible AI means to how organizations implement, secure, govern, and demonstrate accountability (Gupta, LinkedIn, 18 October).
The Lineage Gap. Three standards in one week map neatly to three dimensions, security, regulatory quality management, and organizational governance, and the harmonized citation under the EU AI Act is the one with legal weight for companies selling high-risk systems into Europe. Gupta’s key word is “demonstrate.” Standards do not create trust by being adopted; they create a shared definition of the evidence an auditor or regulator will expect to see. That is useful for boards because it converts a vague obligation (”govern AI responsibly”) into a checklist someone can test. It also raises the cost of the gap seen in earlier signals: once a standard defines the record, an organization without that record is not just less mature, it is nonconforming.
Boardroom Prompt. Which of these three standards applies to your organization, and who has been asked to assess the gap between current practice and what each requires you to demonstrate?
07 · The CEO now owns the AI decision
The Signal. Melissa Rosenthal pointed to BCG’s finding that 72% of CEOs now say they are the main decision-maker on AI at their companies, double last year’s share. Agencies have noticed: on Publicis Groupe’s third-quarter call, Arthur Sadoun said CEOs are getting more involved in the agency’s work. Her concern is for marketing leaders. Almost half of marketing teams have handed tasks to AI, yet only 6.5% track whether it is paying off, and Gartner found only 32% of executives think their CMO makes strong data-based strategy recommendations. Buyers now want business cases and ROI evidence earlier, and if CMOs want a say in how AI money is spent, they need to bring the CEO a plan with real numbers (Rosenthal, LinkedIn, 19 October). Dr. Daniel Jeffrey Koch summarized the BCG report behind the shift, The Formula for Agentic AI Value, based on 1,330 C-suite executives: only 7.5% of companies are “future-built,” and they achieve 2.4 times higher top-line growth and 2.3 times higher three-year shareholder return than laggards. Agentic AI’s share of realized AI value rose from 17% in 2025 to 22% in 2026 and is projected to reach 39% by 2030 (Koch, LinkedIn, 19 October).
The Lineage Gap. When the CEO becomes the AI decision-maker, AI governance becomes CEO governance, and the evidence standard rises with it. A function lead can approve a tool on enthusiasm; a CEO allocating capital across the enterprise needs proof of return, and a board overseeing that CEO needs proof of control. Rosenthal’s 6.5% figure is the warning. Most functions using AI cannot show what it produces, which means the CEO’s AI decisions are being made on activity rather than outcomes. BCG’s agentic trajectory makes this more pressing: if agents produce nearly 40% of AI value by 2030, then the controls discussed in Signals 01 through 04 are not a security sideline. They govern the asset class that will generate most of the return.
Boardroom Prompt. If your CEO is now the main AI decision-maker, what evidence of return and control reaches the CEO’s desk each quarter, and does the board see the same evidence?
08 · Measure value, and keep the people who know what it means
The Signal. Wouter Born responded to an a16z argument that companies need a new kind of CFO. He agrees with half of it: finance does need an AI operating system, and Anthropic’s finance team runs more than 70 AI skills treated like production code, one of which drafts a 90% to 95% complete monthly review in about 30 minutes. But the examples cited were all born on clean technology stacks, while most CFOs run older systems and answer to auditors and boards under controls that took years to earn. The decisions that matter run on context: why a contract is recognized a certain way, which allocation auditors pushed back on three years ago, what the board means by “adjusted.” The sitting CFO carries that context; a new hire, and every agent that hire builds, starts at zero. He notes that 40% of large companies now scale AI agents, yet only 6% get even 5% of EBIT from AI. His advice: keep the CFO, swap the tools freely, and build the system around the person who knows what the numbers mean (Born, LinkedIn, 18 October). Alistair Hofert summarized McKinsey’s The AI Value Curve: a $2.52 trillion annual opportunity in applying generative AI to existing work, with the strongest returns from augmenting high-skilled professionals, and a warning that a 30% swing in AI costs moves the US value pool by roughly $320 billion. Counting users, copilots, and tokens shows technical capability, not economic reality (Hofert, LinkedIn, 23 October).
The Lineage Gap. The 6% figure is a familiar one, and Born adds a reason it stays small: value depends on institutional context that neither new hires nor new agents possess. That is a verification point as much as a staffing one. An agent producing a monthly review at 95% completeness is only as useful as the person able to recognize the 5% that is wrong, and that recognition depends on exactly the context he describes. Hofert’s cost-sensitivity finding belongs in every AI business case review. A plan that works only at today’s token prices has not been stress-tested, and token costs have moved sharply in both directions this year.
Boardroom Prompt. For your largest AI investment, has the business case been tested against a 30% change in AI costs? And who in the organization has the context to catch the part of an AI-generated output that is wrong?
09 · The 2,000-person company needs a new accountability map
The Signal. Mark Minevich, in the week’s second most engaged post here, described the organizational redesign under discussion as AI agents absorb coordination work. Citing Eric Schmidt’s view that once agents handle status updates, planning cycles, information synthesis, and chasing commitments, thousands of roles in a large firm lose their economic reason to exist, he outlined what changes. Spans of control widen from about 7 to 30, which turns management into portfolio oversight that most executives have never been trained for. Accountability must be rewired, because middle management was where ownership and blame used to land; small teams need explicit ownership of end-to-end outcomes, with the AI layer as the system of record. The apprenticeship problem is the one that concerns him most: the middle layer was where future leaders learned judgment, and removing it risks an empty bench in a decade. And regulated and physical businesses will move last, for good reason, because their coordination roles carry compliance, safety, and sovereign accountability that cannot be handed to software until regulators allow it (Minevich, LinkedIn, 22 October).
The Lineage Gap. Headcount forecasts like this deserve caution, and the point that matters for governance does not depend on the number. When the human layer that used to hold accountability shrinks, accountability has to be relocated deliberately or it disappears. Minevich’s phrase “the AI layer as the system of record” is the key design decision. If the record of who decided, which agent acted, and under what authority lives in that layer, a leaner organization can be more accountable than the one it replaces. If it does not, a span of 30 means 30 sets of outcomes no one can trace. His caution about regulated industries is the part executives in financial services, health care, and infrastructure should take seriously: the compliance work done by coordinators is real, and it has to be redesigned, not simply automated away.
Boardroom Prompt. If your organization removed a management layer next year, where would the accountability that layer carried be recorded, and who would hold it?
10 · The model makers become the integrators
The Signal. Ben Appleton reported, citing the Financial Times, that Anthropic and Hg are setting up an independent consultancy to embed AI engineers inside European businesses, with hubs in London and Berlin and an ambition to be worth more than $10 billion within five years. It is the third lab-backed delivery arm this year, alongside an Anthropic venture with Blackstone and Hellman & Friedman in the US and an OpenAI deployment company backed by large private equity firms. The channel is shifting from consulting firms to buyout funds: Hg manages more than $75 billion across 50-plus software businesses, so the sponsor signs and the portfolio company implements. The pressure lands on implementation work that Accenture and the Big Four depend on, even as Anthropic already works inside those firms. His central tension: a consultancy part-owned by a model provider will struggle to say “use someone else’s model,” and as a former Big Four AI leader put it to him, “you can’t really put yourself in that dependency” (Appleton, LinkedIn, 23 October).
The Lineage Gap. For buyers, the question this raises is independence. When the firm designing your AI architecture is part-owned by the company whose model it recommends, the advice may still be good, but it is no longer independent, and the governance process should treat it accordingly. The same principle runs through this whole issue: don’t let the party with an interest in the answer be the only one checking it. Peri applies it to agents’ intent, the FSB applies it to agents’ self-summaries, and it applies equally to advisors. Portfolio companies of private equity sponsors should pay particular attention, because in this model the sponsor may choose the implementation partner before the company’s own leadership is asked.
Boardroom Prompt. For your AI program’s main implementation partner, what are its commercial ties to model providers, and who outside that relationship reviews its architecture recommendations?
The Verification Debt Tracker
The 2×2 from From Artificial to Verified Intelligence. Signal counts this week, with direction vs. last issue.
Agents & Workers held at 8, and the column changed its subject. Last week’s signals were about earning authority; this week’s were about what an agent is trying to do with the authority it already has. Intent drift detection for banks, the separation of authorization from business intent, oversight defined as a record, new standards that define what must be demonstrated, and accountability redesigned around a leaner organization all point to the same missing control: a verifiable statement of purpose, checked by something other than the agent. Adversarial Swarms rose to 2: frontier agents that encoded a protected credential to help another agent, and a week in which AI-assisted research turned a long-deferred software flaw into an emergency patch cycle. Neither involved a malicious agent, which is the point. The Perspective row is quiet for a fourteenth straight week. The season’s direction is now clear: identity tells you who is acting, and the next control tells you why.
Monday Morning
Three things to do next week.
01 · Write down what your top agents are for. For the three agents with the most authority in your organization, write a one-paragraph statement of intent: the purpose, the actions it may take, the systems it may touch, and what would count as drift. Then ask whether anything outside the agent checks its actions against that statement. If nothing does, you have found the gap this week’s lead signal describes.
02 · Run the 100-action test. Pick one production agent and ask for the record of which control applied to each of its last 100 actions. Note two things: whether the record comes from a system or is assembled by hand, and how long it takes. That is the question supervisors are now equipped to ask.
03 · Recheck your patch window. Ask your security lead whether this week’s advisories have been assessed and closed, and how long a critical fix typically takes from disclosure to deployment. Then ask whether that window was set before AI-assisted exploitation shortened the time between discovery and attack.
The Reading Room
Three pieces worth your time this week.
Khushboo Agarwal: AI strategy needs a business architecture (LinkedIn, 18 October, 129 reactions). A clear explanation of why AI pilots stay isolated: without a map connecting capabilities, value streams, processes, information, and technology, one team automates a step, another builds a similar tool, and a third measures success differently. Her strategic question is the right one: where can AI strengthen an end-to-end business capability rather than improve a single task?
Tarek El Araby: Four types of AI ambition (LinkedIn, 18 October, 23 reactions). Drawing on Anthropic’s Felix Rieseberg, he describes speed, altitude, depth, and range as four ways to get more from AI. His advice on depth includes a line worth adopting as policy: get an independent check rather than letting AI grade its own work.
Khwaja Shaik: The AI mandate isn’t an IT project (LinkedIn, 17 October, 5 reactions). From a conversation at the NACD Summit with board director and former CHRO Beth Albright, an argument that AI is erasing the line between HR and IT, and three board questions to match, starting with what the CHRO and CIO co-own, including human-agent accountability.
Trust is expensive. So is its absence.
The Verified Intelligence Briefing is written by Steve Tout, Founder & CEO of Identient and author of The CISO on the Razor’s Edge. It draws from the curated Daily Signal corpus and the Verified Intelligence framework introduced in From Artificial to Verified Intelligence.
If this issue clarified something for you, forward it to one colleague who owns part of the control plane. New here? Subscribe to get The Briefing every Friday morning.
Reply or comment with the question you’d want answered in next week’s issue. Your prompt may become Boardroom Prompt #1.
Connect with Steve: LinkedIn · identient.com · stevetout.com