For the last several years, enterprise AI has benefited from something technology rarely receives for very long:
Permission to experiment.
Boards wanted AI strategies.
CEOs wanted generative AI initiatives.
Technology leaders wanted pilots.
Business units wanted copilots.
And increasingly, organizations wanted AI agents capable of doing more than answering questions. They wanted agents that could retrieve information, interact with applications, execute workflows and take action.
The first question was:
"How quickly can we get AI into the enterprise?"
Then it became:
"How quickly can we deploy AI agents?"
Now the question is changing again:
"What are we getting in return?"
A recent CXOTalk discussion with venture investor Ed Sim captures this transition particularly well. Sim describes enterprise AI as moving toward a third wave in which enthusiasm and capability are no longer sufficient. Organizations increasingly need to demonstrate measurable return on their AI investments.
I believe he is right.
But ROI is only part of the equation.
As AI moves from generating information to taking action, enterprises must solve another problem simultaneously:
Who authorized the AI to act, what is it authorized to do, and how long should that authority last?
That may become one of the defining security questions of the agentic AI era.
The AI Experiment Is Becoming a Business Investment
During the early stages of a major technology shift, experimentation is expected.
Organizations need time to understand what the technology can do.
Generative AI initially benefited from exactly that environment.
Could it write code?
Could it summarize documents?
Could it improve customer service?
Could it analyze data?
Could it help employees work faster?
Those were legitimate questions.
But experimentation eventually encounters economics.
AI consumes resources.
Models have costs.
Infrastructure has costs.
Integration has costs.
Governance has costs.
Cybersecurity has costs.
And the more AI is embedded into business processes, the larger those costs can become.
According to CXOTalk, Sim sees rising token costs combined with increasingly capable alternatives as forcing enterprises to reconsider how AI workloads are allocated. Rather than automatically sending every task to the most powerful frontier model, organizations are beginning to ask which level of intelligence each task actually requires.
That is an important transition.
The question is no longer:
"Which AI model is best?"
It becomes:
"Which AI architecture produces the best business outcome at an acceptable cost and risk?"
That is a much more mature conversation.
Not Every Problem Requires the Most Powerful Model
There is a natural tendency with new technology to assume that more capability is always better.
But businesses do not operate that way elsewhere.
We don't assign our most expensive employee to every task.
We don't use the most powerful computing infrastructure for every workload.
We don't apply the highest level of human expertise to every routine business process.
Why should AI be different?
Sim raises the idea of enterprises increasingly deciding whether to "rent" intelligence from external model providers or "own" more of it through open-weight models and internal infrastructure. He also anticipates environments where workloads are routed according to what each task actually requires.
That makes economic sense.
But it also makes strategic sense.
The future enterprise AI environment will likely involve multiple models, multiple agents, multiple data sources and multiple levels of authority.
Which brings us to a much larger issue.
ROI Is Not Just About Reducing AI Costs
There is a danger in defining AI ROI too narrowly.
If an organization spends $10 million on AI and manages to reduce the cost to $7 million, that doesn't necessarily mean it has created value.
The better question is:
What business outcome did the investment produce?
Did employees become more productive?
Did customer response times improve?
Did transaction costs decrease?
Did revenue increase?
Did errors decline?
Did the organization process more work?
Did customers receive a better experience?
Did AI enable something the organization could not economically accomplish before?
This is why Sim's emphasis on measuring cost per outcome is so important.
CXOTalk describes his approach as comparing the same work performed by a human, by AI, and by a human assisted by AI. He recommends beginning with processes where outcomes can actually be measured.
That last point deserves emphasis.
If you cannot define the outcome, you cannot meaningfully calculate the return.
Sometimes AI's Value Is Not Where You Expect It
One example from the CXOTalk discussion illustrates this particularly well.
A company in Sim's portfolio evaluated a 57-step insurance claims process by comparing humans with AI. At first, the customer believed the AI had performed poorly.
Detailed process measurement showed something different.
According to the article, the AI was correct approximately 98 percent of the time in the measured exercise, compared with approximately 85 percent for the humans. Because the workflow had been recorded step by step, the organization could evaluate what actually happened rather than relying on perception.
There is an important lesson here.
AI ROI requires observability.
Organizations need to know what happened.
What decision was made?
What action was taken?
What did it cost?
What was the result?
Was it correct?
Who authorized it?
Those questions lead directly into cybersecurity.
The Biggest Agentic AI Security Problem May Be Identity
One of the most important points in the CXOTalk article has surprisingly little to do with the AI model itself.
It concerns identity and access.
Sim asks a deceptively simple question.
If a person is logged into an enterprise application, should that person's AI agent inherit access indefinitely?
His answer is no.
Instead, he argues that agents should receive narrowly scoped access at runtime and that the permission should expire when the task has been completed.
This is a critical idea.
Because AI agents are not simply another category of employee.
They can operate continuously.
They can work at machine speed.
They can interact with multiple systems.
They can initiate workflows.
They can communicate with other agents.
They can potentially execute thousands of actions before a human realizes something has gone wrong.
Giving an AI agent broad, persistent credentials could therefore create an entirely new class of enterprise risk.
Authentication Is Only the Beginning
This brings us back to something we have discussed frequently at Identité.
Authentication is essential, but authentication alone is not enough.
Authentication answers:
"Who are you?"
and:
"Can you prove it?"
But once identity has been established, another question becomes equally important:
"What are you authorized to do?"
That distinction becomes even more important with AI agents.
Imagine a CFO authorizes an AI agent to prepare financial information.
Should the agent automatically be authorized to transfer money?
Of course not.
An employee might authorize an AI agent to access a CRM system.
Should the agent retain that access forever?
No.
An AI purchasing agent might be permitted to purchase supplies up to $500.
Should it automatically be permitted to authorize a $50,000 purchase?
Again, no.
Identity does not equal unlimited authority.
This principle applies to humans.
It applies to applications.
And it absolutely must apply to AI agents.
Authorization Must Follow the Action
Consider the financial-services example we have discussed previously.
A banking customer authenticates to a mobile application.
Authentication establishes identity.
The customer checks a balance.
No unnecessary additional friction.
They review recent transactions.
Again, no reason to create an obstacle simply for the sake of demonstrating that security exists.
Then the customer attempts to wire $5,000.
Suppose the bank has established a policy requiring additional authorization for wire transfers exceeding $1,000.
The risk has changed.
So the security response changes.
The customer is asked to authorize the specific transaction.
The same principle can apply to AI.
An agent may be permitted to perform routine actions automatically.
But once an action exceeds a defined financial, operational or risk threshold, human authorization can be invoked.
This creates a much more intelligent relationship between automation and control.
AI Agents Need Boundaries, Not Just Credentials
One of the most dangerous assumptions organizations could make is that giving an AI agent an authenticated identity solves the security problem.
It doesn't.
Authentication tells us which agent is operating.
Authorization determines what that agent is permitted to do.
Least privilege determines how much access it receives.
Context helps determine whether the requested action makes sense.
Intent helps establish whether the human actually requested the action.
Runtime authorization can limit how long that authority exists.
And continuous verification can reevaluate trust as circumstances change.
This gives us a framework for agentic AI security:
Identity + Authentication + Authorization + Intent + Context + Least Privilege + Runtime Access + Continuous Verification
That is much more powerful than simply giving an agent a username and password.
Authorization Should Be Temporary and Specific
The runtime-access concept highlighted in the CXOTalk article is particularly important.
Instead of giving an agent permanent credentials to an application, imagine granting authority for a specific purpose.
Agent: Accounts Payable Agent
Task: Process approved supplier invoices
Systems: Accounts payable platform
Authority: Prepare payments up to defined limits
Duration: Valid only while the approved task is running
Higher-risk action: Requires human authorization
When the task ends, the authority expires.
If the agent is compromised later, an attacker does not necessarily inherit a permanent credential providing broad access to enterprise systems.
This reflects the Zero Trust principle of least privilege in a form designed for machines.
Give the agent what it needs, when it needs it, for as long as it needs it.
Nothing more.
Containing the Blast Radius
Sim identifies another reason temporary, scoped authorization matters.
Containment.
If enterprises eventually operate thousands of agents and one becomes compromised, the objective should be to prevent that compromise from becoming an enterprise-wide event. Runtime permissions can help restrict the blast radius to the limited authority granted for that particular task.
This is exactly how organizations should think about AI security.
The goal cannot simply be:
"Make sure nothing ever goes wrong."
Something eventually will.
The architecture must also answer:
"What happens when it does?"
How much can the compromised agent access?
What actions can it execute?
How quickly does its authority expire?
Can its authorization be revoked?
Can the organization determine exactly what it did?
Those questions belong at the center of enterprise AI architecture.
Human Authorization Becomes More Valuable as AI Becomes More Autonomous
There is an interesting paradox here.
As AI becomes more autonomous, human authorization becomes more important, not less.
The objective should not be to require human approval for everything.
That would defeat much of the value of automation.
Instead, organizations should establish thresholds.
Routine, low-risk actions can proceed automatically within clearly defined policy.
Higher-risk actions require explicit authorization.
A $50 purchase might proceed automatically.
A $50,000 purchase might require an executive.
A routine customer-service action might be automated.
Closing an account might require human authorization.
An AI agent might prepare a wire transfer.
Moving the money might require an authorized human.
This is how organizations can obtain the productivity benefits of autonomous AI without granting machines unrestricted authority.
Intent Matters Too
Authorization alone still leaves another question.
Did the human actually intend to authorize the action?
This matters because humans themselves can be manipulated.
An attacker might attempt to trick an employee into approving an AI-generated request.
An employee may receive multiple approval prompts and eventually click one reflexively.
A generic notification asking:
"Approve?"
may provide insufficient information.
A better authorization experience should provide context.
What is being authorized?
Which agent requested it?
What action will occur?
What system will be affected?
What amount is involved?
Who initiated the workflow?
That is why authentication intent is an important part of the Identité philosophy.
We want the person approving an action to understand what they are approving.
Full Duplex Authentication® Adds Mutual Trust
Agentic AI introduces yet another trust problem.
It will become increasingly difficult for humans to know whether the digital request appearing in front of them actually originated from the system they believe it did.
AI can generate convincing emails.
Convincing websites.
Convincing messages.
Convincing support interactions.
Convincing approval requests.
Identité's patented Full Duplex Authentication® was designed around mutual authentication.
Traditional authentication primarily asks:
"Are you really you?"
Full Duplex Authentication® addresses trust in both directions.
The legitimate user participates in establishing identity.
The legitimate destination participates in establishing legitimacy.
As AI makes digital impersonation increasingly convincing, the ability to establish trust in both directions becomes more important.
Less Friction Still Matters
None of this means enterprises should bury employees under additional security prompts.
That would undermine the very ROI organizations are attempting to obtain from AI.
If AI saves an employee ten minutes and the authorization process adds five minutes back, the economics deteriorate quickly.
The better approach is risk-based friction.
Allow routine, low-risk actions to proceed according to predefined authority.
Invoke additional authorization when risk increases.
Require explicit human involvement for consequential actions.
Then return security to the background.
This is the same principle we apply to human authentication:
The right security, for the right identity, around the right action, at the right time.
AI ROI and AI Security Are Becoming the Same Conversation
This is perhaps the larger lesson from the CXOTalk discussion.
Organizations cannot evaluate AI ROI independently from security.
An agent that reduces operating costs by 30 percent but creates unacceptable access risk has not delivered a successful business outcome.
An agent that automates a workflow but requires constant human intervention has not achieved meaningful autonomy.
An agent that increases productivity but receives unrestricted access to enterprise systems may create more risk than value.
And an agent that performs transactions without clear authorization creates an accountability problem.
The real enterprise AI equation therefore looks something like this:
Business Outcome + Measurable Return + Defined Identity + Limited Authority + Human Accountability + Acceptable Risk
That is a much higher standard than simply demonstrating that AI can perform a task.
It should be.
The Prove-It Era Has Arrived
Enterprise AI is entering a more mature phase.
The excitement isn't disappearing.
The expectations are increasing.
Executives will increasingly ask:
What does this AI system cost?
What measurable outcome does it produce?
Is it better than the process it replaced?
Which model actually needs to perform the work?
What data can the agent access?
Who authorized it?
What is it allowed to do?
When does that authority expire?
Which actions require human authorization?
Can we determine exactly what happened afterward?
Those are the questions that separate experimentation from enterprise infrastructure.
The Identité Perspective: Trust Must Scale With Intelligence
The next generation of AI will not simply provide information.
It will act.
That changes everything.
As machines receive greater capability, organizations must become more precise about authority.
Authentication establishes identity.
Authorization establishes boundaries.
Intent connects the human to the requested action.
Least privilege limits exposure.
Runtime access limits duration.
Continuous verification reevaluates trust.
Human authorization protects consequential decisions.
And mutual authentication can help establish confidence in the digital relationship itself.
This allows organizations to pursue something extremely important:
More automation without surrendering control.
That is where AI can truly become a catalyst for growth.
The companies that win the next phase of enterprise AI will not necessarily be those with the most agents or the largest AI budgets.
They will be the organizations that can prove three things:
It works.
It pays.
And it can be trusted.
That is the standard enterprise AI now needs to meet.