The first wave of workplace AI answered questions. The next wave takes actions: it files, sends, updates, schedules and submits. For regulated organisations, that shift changes the governance problem. A wrong answer can be reviewed before anyone relies on it. A wrong action may already have happened.
The principle we build around is short: agents have permissions, not trust. This article explains what that means in practice and why each part of it is there.
Why “trust” is the wrong model
It is tempting to treat a capable agent the way we treat a capable colleague: give it a goal and some latitude, and trust it to use judgement. That model breaks down for a simple reason. An agent’s behaviour is shaped by its inputs, and some of those inputs are written by people who are not on your side.
A document it reads can contain instructions. A web page it retrieves can tell it to forward a file. A supplier’s email can ask it, very politely, to change the bank details on an invoice. If what the agent is allowed to do depends on what the agent concludes it should do, then anyone who can influence its inputs can influence its authority. That is not a hypothetical weakness of today’s models; it follows from how they work.
Permissions solve this by moving authority out of the agent’s reasoning. The agent can propose whatever it likes. What it can actually do is decided elsewhere, in advance, by people accountable for the decision.
Four rules that make permissions real
1. Permissions are fixed before the task starts
An agent receives a defined set of tools, data sources and destinations for a task. It cannot add to that set during the task, and nothing it reads or generates can add to it either. Model output is treated as content, never as a grant of authority.
2. Consequential actions wait for a person
Some actions should never happen without a human decision: sending information outside the organisation, changing records of account, or anything with legal or regulatory effect. For those, the agent prepares the action and stops. An authorised person decides.
3. Approval binds to exactly what was approved
The weakest kind of approval is a general “yes, go ahead”. The agent, or whatever is influencing it, can then do something slightly different from what the person saw. A stronger approval binds to the exact action: the destination, the arguments and the payload, captured in a precise, canonical form and fingerprinted with a hash. If anything changes between approval and execution, the fingerprint no longer matches and the action is refused.
Two details make this robust. The check is repeated immediately before execution, not just at the moment of approval. And each approval can be used once, so an approved payment cannot be replayed a second time.
4. The approver is not the requester
An agent cannot approve its own proposal, and a person should not be able to approve an action they cannot see. The approval screen has to show what will actually happen, in terms the approver understands, not a summary written by the agent that proposed it.
What this looks like for real work
These rules shape the agents Synainesi plans for its Pilot. A regulatory monitoring agent can read allowlisted public sources and produce evidenced summaries of change, but it cannot change policy, contact a regulator or make a submission. A policy review agent can propose cited wording, but it cannot publish or activate policy. A KYC file review agent can organise and check facts in authorised files, but onboarding decisions, risk ratings and suspicion conclusions stay with an authorised person and the organisation’s own system of record.
In each case the useful work, reading, comparing and organising, is exactly the work that benefits from AI, and the consequential decision is exactly the part that stays human.
Questions to ask before an agent acts for you
- Can anything the agent reads change what it is allowed to do? The answer should be no, and should be enforced outside the model.
- Which actions require a human, and who decides that list?
- Does approval cover the exact action and payload? What happens if either changes after approval?
- Can an approval be reused? It should not be.
- What evidence is left of each proposal, approval and refusal?
Capable agents will be genuinely useful in regulated work. They will be usable only if their authority comes from permissions that people set, rather than from trust that their inputs can manipulate.
Related: how Synainesi works and why a setting is not a control.