OPEN CHRONICLE TECHNOLOGY | ARTIFICIAL INTELLIGENCE & MACHINE LEARNING

From answering questions to executing business operations, artificial intelligence is entering a new phase. Microsoft, Google and other technology companies are building systems capable of working across applications and digital infrastructure. But as AI gains the ability to act, organisations face a new challenge: controlling what those systems are allowed to do.

By Open Chronicle Technology | November 13, 2026

1. Artificial intelligence is crossing a new threshold

For years, the public experience of artificial intelligence was largely conversational.

Users entered questions, requested summaries, generated images or asked software to produce text and code. Even when the technology was sophisticated, the interaction generally followed a familiar pattern: a person made a request, and the system produced an answer.

That relationship is changing.

A new generation of AI systems is being designed not merely to generate information but to execute tasks.

These systems, commonly described as AI agents, can combine language models with software tools, external data, application programming interfaces and automated workflows.

Instead of simply explaining how to organise a meeting, an agent may be authorised to examine calendars, identify available times, prepare invitations and update scheduling systems.

Instead of summarising a customer complaint, it may retrieve account information, classify the issue, prepare a response and initiate an approved support process.

In a corporate environment, agents may work across email, databases, collaboration platforms, customer management systems and cloud infrastructure.

The difference is fundamental.

Traditional generative AI primarily produces content. Agentic AI can be given the authority to produce consequences.

That shift is already influencing the strategies of major technology companies.

Microsoft has expanded its approach to managing enterprise AI agents through Agent 365. Google has introduced a broader enterprise agent platform and additional infrastructure for running and governing autonomous workloads.

Both companies increasingly describe agent identity, permissions, monitoring and governance as essential parts of deploying AI at scale.

The emerging question is no longer whether AI can perform useful tasks.

It is whether businesses can safely delegate those tasks without losing control over their information, operations and responsibilities.

2. What exactly is an AI agent?

An AI agent is a software system designed to pursue an objective through a sequence of decisions and actions.

Its capabilities vary according to its architecture.

Some agents follow tightly defined workflows and have limited authority. Others can dynamically select tools, retrieve information, plan intermediate steps and adapt their actions according to the results.

A typical enterprise agent may combine several components.

But the model alone does not make the system operationally autonomous.

Autonomy emerges when the model is connected to tools that can interact with the outside world.

Those tools might include a calendar service, a database interface, a browser, a document repository or a business application.

The agent can then translate an objective into a sequence of actions.

Crucially, the agent should not be able to grant itself unlimited authority.

Its permissions must be defined and enforced by the systems surrounding the model.

This distinction between reasoning and authorisation is one of the most important principles in agent security.

3. Microsoft is building an operating environment for digital workers

Microsoft’s enterprise strategy provides a clear example of how the industry is approaching agentic AI.

The company has developed several tools for creating agents, including Microsoft 365 Copilot’s Agent Builder, Copilot Studio and Microsoft Foundry.

These products serve different levels of complexity, from relatively simple workplace assistants to custom enterprise applications.

In August 2026, Microsoft described its internal deployment of Agent 365, reporting visibility into more than 500,000 agents across its own environment.

That figure represents Microsoft’s internal agent inventory, not 500,000 autonomous employees or a count of agents independently performing complex tasks.

The scale illustrates a problem that becomes increasingly significant as organisations adopt agents.

How does an IT department know which agents exist?

Who owns them?

Which business applications can they access?

What happens when an employee leaves the company but an agent they created remains active?

How can security teams investigate an agent that performs an unexpected action?

Microsoft’s approach includes agent registries, identity management, monitoring and security controls.

Its guidance also emphasises that agents should operate within established corporate security and compliance boundaries.

This reflects a wider transformation in enterprise IT.

Traditional administration has focused heavily on human users, devices, applications and services.

AI agents introduce another operational identity that must be managed.

An agent may need access to information and systems, but it should receive only the permissions necessary to complete its assigned work.

The technology therefore creates a new governance challenge.

Organisations must manage not only what employees are allowed to do, but also what software agents are authorised to do on their behalf.

4. Google is pursuing the autonomous enterprise

Google is following a related strategy through its enterprise AI infrastructure.

In April 2026, Google Cloud introduced the Gemini Enterprise Agent Platform, describing it as a foundation for developing, deploying, governing and optimising AI agents.

The platform brings together model development, agent creation, integration, orchestration and security capabilities.

In October, Google announced Agent Compute Engine, designed to provide infrastructure for agent execution with hardware-isolated sandboxing. The company said the service would become available in preview in the following months.

The emphasis on isolated execution environments is significant.

An agent that can run code, access applications or manipulate files introduces risks that do not exist in a simple text conversation.

Separating agent workloads from sensitive infrastructure can help limit the consequences of errors or malicious manipulation.

Google has also described mechanisms for agent identity, policy enforcement and auditing.

Its September announcement of an agent anomaly detection capability, initially in private preview, focused on identifying suspicious behaviour that may not appear in conventional success or failure metrics.

This reveals an important industry trend.

Technology companies are no longer competing solely on the intelligence of their AI models.

They are also competing on the infrastructure required to operate AI systems reliably.

The ability to manage thousands of agents may become as important to enterprise customers as the ability to generate accurate answers.

5. The security problem: an agent can make a mistake at machine speed

The risks associated with autonomous AI are not simply extensions of traditional chatbot errors.

A chatbot that produces an incorrect answer may mislead a user.

An agent that acts on an incorrect interpretation may change a database, send confidential information or trigger an unintended business process.

The consequences depend on the authority assigned to the system.

Security specialists have identified several important categories of risk.

Prompt injection deserves particular attention.

An agent may need to read documents, emails or web pages to complete its work.

An attacker can attempt to place instructions inside that external content, hoping the agent will treat those instructions as authoritative.

Consider a hypothetical purchasing agent.

Its legitimate task is to review supplier quotations and prepare a comparison.

One quotation contains hidden text instructing the agent to send internal pricing documents to an external address.

If the system fails to distinguish untrusted document content from authorised instructions, it could attempt to carry out the malicious request.

The attack does not necessarily require compromising the agent’s underlying model.

It exploits the relationship between the information the agent reads and the actions it can perform.

Australia’s cyber authorities have highlighted this challenge in guidance published in 2026, noting that no fully reliable technical mitigation for prompt injection currently exists.

Their recommendations emphasise limiting access, controlling permitted actions and applying security measures around the model.

The implication is clear.

An intelligent agent is not automatically a secure agent.

6. Why traditional cybersecurity controls are not enough on their own

Conventional enterprise security relies on established mechanisms such as identity management, access control, network monitoring, application security and audit logs.

These remain essential.

However, autonomous agents introduce additional complexity because their behaviour may vary according to the information they encounter.

Traditional software typically executes functions according to explicitly programmed logic.

AI agents may choose among several permitted actions, depending on their interpretation of a task.

This creates situations where an action is technically authorised but operationally inappropriate.

For example, an agent may have permission to send email.

That permission does not mean every email it decides to send is legitimate.

An agent may be authorised to update customer records.

That does not guarantee that every update reflects the user’s intention.

Security therefore requires controls at several levels.

7. The productivity opportunity is substantial

Despite the risks, the potential value of AI agents is significant.

Many business processes involve repetitive tasks distributed across multiple applications.

Employees may spend considerable time transferring information between systems, checking records, preparing routine documents and coordinating approvals.

Agents could reduce some of that administrative burden.

A finance team might use an agent to collect invoice information, identify discrepancies and prepare exceptions for review.

A customer support department might use agents to classify requests, retrieve relevant account information and draft responses.

An IT department might use agents to analyse service alerts, correlate incidents and prepare troubleshooting recommendations.

Software development teams might use agents to inspect code, run tests and propose changes.

In each case, the value depends on accuracy, reliability and appropriate supervision.

Not every process should be automated.

Tasks involving sensitive personal information, legal commitments, financial transfers or safety-critical operations require stronger controls.

The economic argument for agentic AI is therefore not simply that software can replace manual work.

It is that software may be able to coordinate parts of complex workflows more efficiently.

But any productivity benefit must be evaluated against operating costs, error rates, security exposure and the time employees spend supervising the system.

An agent that completes a task quickly but requires extensive correction may provide little real advantage.

8. The emergence of the digital workforce

The concept of a digital workforce is becoming increasingly relevant.

In this model, organisations manage human employees and software agents as distinct participants in business processes.

The comparison has limits.

AI agents are not employees, do not possess human professional judgment and should not be treated as independent holders of corporate responsibility.

Nevertheless, some management practices overlap.

Agents need defined roles, access permissions, operational supervision and procedures for retirement.

They may also require performance monitoring and periodic reassessment of their usefulness.

This creates new responsibilities for IT departments.

An organisation deploying hundreds of agents needs to know which systems they use, who authorised them and what happens when they malfunction.

It also needs policies governing the creation of new agents.

Without such controls, businesses risk agent sprawl, a situation in which numerous automated systems operate with fragmented oversight.

Microsoft has explicitly identified uncontrolled agent proliferation and inconsistent architectures as risks to enterprise adoption.

The challenge resembles earlier waves of enterprise technology adoption.

Cloud services, mobile devices and software subscriptions all created governance problems when adoption expanded faster than organisational controls.

AI agents may accelerate that pattern because creating a new agent can be easier than building a traditional software application.

The result could be a rapidly expanding population of automated systems interacting with sensitive business infrastructure.

9. Who is responsible when an AI agent makes a damaging decision?

This may become one of the defining questions of the agentic AI era.

Suppose a company deploys an agent authorised to negotiate routine supplier purchases within predefined limits.

The agent misinterprets a document and places an incorrect order.

Who is accountable?

The employee who requested the task?

The manager who approved the agent’s deployment?

The developer who designed its workflow?

The organisation that granted the agent access?

Or the technology provider supplying the underlying AI model?

The answer depends on the circumstances, contractual arrangements, applicable law and the nature of the failure.

But one principle should remain central.

Delegating an action to software does not automatically eliminate human or organisational accountability.

A responsible deployment requires clear ownership before an incident occurs.

The organisation should define who approves the agent’s authority, who monitors its behaviour, who can suspend it and who investigates failures.

Developers and platform providers have responsibilities for the security and reliability of the components they supply.

The organisation deploying the agent must also establish appropriate controls over its use.

Responsibility may therefore be distributed across several parties rather than assigned exclusively to one individual.

This is particularly important when agents operate across organisational boundaries.

An agent working with a cloud service, a third-party database and an external business platform may create a chain of dependencies that complicates incident investigation.

Auditability becomes essential.

If a company cannot reconstruct what an agent did and why a transaction occurred, accountability becomes difficult to establish.

10. Five questions every organisation should answer before deploying autonomous AI

These questions should be addressed before large-scale deployment.

Organisations that begin with narrowly defined use cases are better positioned to evaluate benefits and risks.

An agent designed to summarise internal reports requires a different level of control from one authorised to modify financial records.

The degree of autonomy should reflect the potential consequences of failure.

11. The next phase of AI competition will be about trust

The first major wave of generative AI competition focused on model capabilities.

Technology companies competed to demonstrate improvements in reasoning, coding, language understanding and multimodal processing.

Those capabilities remain important.

But enterprise customers increasingly need something else.

They need systems that can operate reliably within established business environments.

That requires identity management, secure integration, predictable execution, observability and effective governance.

Microsoft’s Agent 365 strategy and Google’s enterprise agent infrastructure illustrate this shift.

Both companies are investing in the systems required to manage AI agents as operational components of enterprise technology.

This could change how organisations evaluate AI products.

The most attractive model may not always be the one that performs best on a benchmark.

It may be the one that can complete useful tasks within a secure, auditable and economically sustainable environment.

Reliability could become a decisive competitive advantage.

So could the ability to demonstrate that an agent respects organisational boundaries even when it encounters misleading or malicious information.

Conclusion: from artificial intelligence to delegated authority

The rise of autonomous AI agents represents a significant evolution in the relationship between people and software.

Artificial intelligence is moving beyond generating answers and towards executing tasks across digital systems.

That transition creates opportunities to improve productivity, simplify workflows and develop new forms of enterprise automation.

It also introduces risks involving permissions, security, accountability and operational control.

The central challenge is not whether agents can become more autonomous.

They almost certainly will.

The challenge is determining how much autonomy organisations should grant them, under what conditions and with which safeguards.

Companies that treat agents merely as more powerful chatbots may underestimate the consequences of connecting them to real business systems.

Those that treat agents as governed software components, with clear identities, restricted permissions, human oversight and auditable actions, will be better positioned to benefit from the technology.

The future of enterprise AI may ultimately depend less on how independently an agent can act than on how reliably an organisation can control those actions.

The next revolution in artificial intelligence will not be defined only by what machines can think. It will be defined by what we allow them to do.