Before You Give AI Arms

“Seventy-nine percent of enterprises now run AI agents in production. Two percent have identity tools built to govern them.”

That is from SailPoint’s Horizons of Identity Security report, released October 6. Read it twice. The gap between those numbers is where the risk lives.

Agents went mainstream before governance caught up. That is the entire story of 2026 in one statistic.

Chat Gives Words. Agents Take Actions.

A chatbot gives a bad answer and you ignore it. The cost of being wrong is low.

An agent with arms is different. It books the meeting. It sends the email. It moves the file. It runs the script. The question is no longer “is it smart enough.” The question is “what is it allowed to touch.”

This is the transition everyone is living through right now: from AI you talk to, to AI that acts on your behalf. The buying decision changes completely. You are not choosing a smarter chat window. You are hiring something with permissions, and most buyers are still shopping like it is a chat window.

Seven Tools, Seven Job Descriptions

The current desk: Dots, Muse, Instinct, Hermes, ChatGPT Desktop, Google’s Workspace agents, and Copilot.

Dots is OpenAI’s always-on agent. It does not wait to be asked. It watches ongoing work and acts. The job: continuity.

Muse is the thinking partner. Research, drafting, analysis, the long back-and-forth. The job: depth.

Hermes is the local heavy lifter, a harness built for serious work under direct control. The job: power without sending everything to someone else’s cloud.

ChatGPT Desktop is the quick-draw chat window for the questions that cannot wait for a full session.

Google’s Workspace agents live where the work already happens: Gmail, Drive, Docs, Calendar. Google launched the Gemini agent on October 8 as a persistent coworker with memory and permissions across all of it. The job: context.

Copilot Cowork is the agent-level Copilot. Not the chat assistant that answers one question in one app, but the layer that takes a goal, builds a plan, and executes it across Outlook, Teams, Word, Excel, and SharePoint, checking in before anything sensitive. It brings a model picker with it: GPT or Claude families under the hood. The job: the other half of the office, with arms.

Instinct is the newest addition. It is still earning its job description.

The point of the list is not the list. Products change monthly. The point is that every tool on the desk has a defined job. Nothing is there because the demo was impressive.

Sort the Job First: Personal or Work?

Not every agent needs the full five-question treatment. The first cut is simpler: is this a personal job or a work job?

Personal jobs run on your data and your time. Notes, ideas, research, a draft, the quick question at 10 p.m. The blast radius is you. If the agent gets it wrong, you lose an hour.

Work jobs run on other people’s data. Member lists, financials, anything shared, anything regulated, anything a board will see. The blast radius is the organization. If the agent gets it wrong, the cost is trust, money, or compliance.

Most people skip this cut. They pick a favorite agent and use it for everything. Then work data ends up in the personal tool, and that is how shadow AI happens. Not malice. Convenience. The associate pasting client data into a free chatbot on a personal laptop is not choosing the wrong agent. She is using a personal agent for a work job.

Match the agent to the context first, then to the task. Personal agents get latitude. Work agents get the five questions and the audit trail.

The Five Questions

Before any agent gets access to anything that matters, it should answer five questions.

What can it touch? Give the agent the smallest set of permissions that lets it do its job. An agent that drafts emails does not need delete access to the file server. Scope is the first safety control, and it is free.

What can it break? Sort every action into reversible and irreversible. Drafting is reversible. Sending, deleting, purchasing, and publishing are not. The irreversible list is where the human approval step lives. Decide this before deployment, not after the first mistake.

Who approves what? The rule is simple: the bigger the blast radius, the closer the human. A draft can go out on its own. A payment cannot. Write the rule down. “The agent decides” is not a rule. Ask every vendor what their agent is not allowed to do. A shrug is an answer.

Where is the receipt? If the agent acts, there must be a log: who asked, what it did, what it touched, when. No log, no deployment. This is the piece most teams skip. It is also the first thing anyone asks for when something goes wrong.

Who holds the kill switch? Headline prices mislead on agents because they never stop generating. The decision question is not what it costs. It is who watches the meter. Every agent needs a spending ceiling and a named human who can pull the plug.

Five questions. None of them are about which model it runs.

For a personal job, these are thirty-second gut checks. For a work job, they are policy. The questions do not change. The rigor does.

Count the Cost

There are two bills, and most buyers only see one.

The first is subscriptions, and the range is wider than the marketing suggests. ChatGPT Plus is $20 a month, but Dots only ships with Pro at $100 and up, or Business Premium at $100 per user per month on annual billing. Muse runs $20 to $100 a month across its tiers, with a free tier underneath. Cowork needs the $30 per user Microsoft 365 Copilot license first, plus $15 per user for the governance console unless you are on the $99 E7 bundle. Google’s Gemini agent is enterprise only with no public list price. Instinct is free in beta with no published pricing at all, which means its price is still to come. Seven tools on the corporate card, and nobody remembers approving the fourth one. Audit the stack quarterly. If a tool cannot name its job, cancel it.

The second is usage. Token-metered agents bill by the action, and not all actions cost the same. An agent that replays forty-seven clicks through a web interface costs far more than one that calls the same system’s API directly. The expensive path is usually the one that looks most like a human doing the job. Chatting with a Dots dot does not count against plan limits, but the tasks it starts do. The meter runs on what the agent does, not on what you say. Hermes has no subscription at all. The bill is local compute or API tokens, which is the most honest pricing in the stack: you see every unit you burn.

Here is what the price sheets share: none of them tell you what you will actually spend. A subscription is a floor, not a total. An agent that never stops generating never stops billing. The vendors know this. Muse’s tiers throttle at the cap instead of charging overages. Google’s agent pauses work at the spending cap until a human approves more, with per-project chargeback so the bill lands where the work happened.

Read the fine print beyond the price, too. Instinct’s terms already appoint it as your agent for binding agreements, with training on your data switched on by default. That is a governance question wearing a pricing question’s clothes.

Set a ceiling. Every agent gets a budget, a named watcher, and a kill switch.

Agents Are Identities Now

Here is the shift most organizations have not made yet, and it is the one that matters most for anyone running a small shop: an agent with permissions is not a tool. It is an identity, the same as a new hire with a login, which means it should be provisioned like one, with defined access, periodic review, and instant revocation. Nobody does this. Everyone means to.

SailPoint’s enterprise answer involves continuous monitoring and kill switches that cut one agent’s access without breaking everything else. The small-shop version is simpler: the five questions above, plus a quarterly review of what each agent can still touch.

Permissions drift. Agents accumulate access the way employees accumulate passwords.

The Decision

The agent you choose matters less than the boundaries you set. Products will keep launching. The framework does not expire.

Give every agent a job description, a blast radius, an approver, a receipt, and a budget. Then let it work.