Operational AI. Human authority.
Internet
Joined January 2017
- Tweets172
- Following10
- Followers40
- Likes127
Intelliger AI retweeted
I think we are still very early in understanding what enterprise AI will actually look like.
Right now most of the attention and capital is going into models, compute and generic agents.
I think a lot of the long-term enterprise value will sit somewhere else.
In the knowledge of how work actually gets done.
A thread.
Intelliger AI retweeted
The most dangerous part of an enterprise agent is not the model. It is the gap between a tool call and a verified outcome. Production agents need a control loop, not a larger toolbox. I map the seven stages in this article. #AgenticAI #EnterpriseAI
Intelliger AI retweeted
Your agent remembers that a supplier was approved last month. Is that permission to pay them today? No. Memory is a lead, not authority. Before it drives action, verify source, age, tenant, purpose, and status. #AgentMemory #AIGovernance
Every consequential AI decision contains several layers.
What is happening?
Which policies apply?
Who has the authority to decide?
What evidence supports the outcome?
A confident answer can hide these questions. A well-designed system makes them visible.
1
18
A model may see a prompt. Your organisation sees the decision, the consequences and the people accountable for what happens next.
Enterprise AI needs more than a capable model. It needs the right evidence, policies, permissions and human boundaries around every important action.
1
12
What is the biggest missing layer in production agent systems?
A) verified agent ownership
😎 delegated authority
C) runtime policy enforcement
D) verifiable transaction evidence
Reply with the failure mode you have actually encountered.
#AIAgents #DevCommunity
6
27
A log tells the service what it recorded.
An OATI Receipt gives both organizations signed evidence connecting:
• the agent
• its mandate
• the policy decision
• the action
• the released output
Agent transactions need shared evidence.
#Cybersecurity #EnterpriseAI
6
19
The most important rule in agent delegation:
A sub-agent must never receive more authority than its parent.
Not a larger budget.
Not broader data access.
Not a longer expiry.
Not an additional destination.
Delegation must only narrow.
#AISecurity #AIGovernance
6
16
An API key proves access to a credential.
It does not prove:
• who owns the agent
• why it is acting
• who delegated authority
• where the data may go
• what it may spend
An API key is not an agent mandate.
#APISecurity #AIAgents
5
14
We are building OATI openly because agent trust should not become another proprietary silo.
We will share specifications, schemas, SDKs, threat models and implementation decisions.
If you build agents or agent-facing APIs, what should we test first?
#OpenSource #DevCommunity
5
15
OATI connects four verifiable objects:
OATI-ID identifies the agent.
A Passport establishes ownership.
A Mandate defines its authority.
A Receipt provides signed evidence of the transaction.
Identity is not permission. Access is not authority.
#DigitalIdentity #AIGovernance
4
8
An external agent can arrive with a valid token and still leave the important questions unanswered:
Who owns it?
Who authorized it?
What data may leave?
What can it spend?
Where is the shared proof?
OATI addresses this missing transaction layer.
#AISecurity
4
9
At Intelliger, we keep returning to one uncomfortable question:
When an AI agent acts across a company boundary, what proves it was allowed to perform that exact action?
A valid API key does not answer that.
This is why we are building OATI.
#AgenticAI #AIAgents
4
21
Intelliger AI retweeted
When an AI agent acts for a company, access is not enough.
We need to know:
Who owns it?
Who authorized this action?
Which limits apply?
What evidence remains?
OATI is an open standard for trusted agent transactions.
We are building it in public.
#AIAgents #OpenSource
Intelliger AI retweeted
The OATI transaction model:
OATI-ID identifies the agent.
Passport establishes ownership.
Mandate defines authority.
Policy controls the action.
Receipt provides signed evidence.
Each object answers a different trust question.
#AgenticAI #DigitalIdentity
Intelliger AI retweeted
An API key proves that an agent has access to a credential.
It does not prove who delegated authority, why the agent is acting, what data may leave or how much it may spend.
Access is not authority.
An API key is not a mandate.
#APISecurity #AIAgents
Intelliger AI retweeted
An Agent Card describes what an agent can do.
An OATI Passport establishes who owns and operates it, which issuer verified it and whether the record is still valid.
Discovery helps agents find each other.
Discovery should never grant permission.
#A2A #DigitalIdentity