Tom Loosemore

[Edit 5th Aug 2026: A friend kindly pointed out that modern LLMs are now getting very good at using your PC for you, exactly as you would have done. In which scenario I doubt services will ever be able to spot that it’s an LLM in control, since PCs allow it to precisely replicate normal human user behaviour. I’m assuming in the piece below that most AI Agent activity is through something akin to next generation LLM-powered personal assistants, for example, future versions of Apple Siri or Google Gemini on mobile or new devices. You would hope they would identify themselves to services as agents. But that hope could be misplaced.]

Back in March, I was beaten by the bins. I’d spent a happy few evenings (and a great many tokens) trying to build a simple web app: share any UK address, find out which bins to put out, and when. Britain’s 350-odd local councils defeated me. Broken APIs, JavaScript-infested iframes, one council that will only let you navigate by road name, and, everywhere, bot-blocking.

The bot-blocking is the bit that matters here. My software was, technically, a bot. It was also acting for a resident who just wanted to know her bin day. The councils’ defences couldn’t tell the difference, because nothing about the request told them. They saw automation, and said no.

Scroll forward a few years. It’s not a hobbyist coder checking bin days any more; it’s an AI agent submitting your mother’s blue badge application, or filing a well-argued parking-fine appeal at 11.52pm because its owner got home late from work. At the front door, the question is identical: is this software an attack, or somebody’s legitimate representative? Today, your service cannot answer it.

A couple of weeks ago I blogged about Know Your Agent (KYA), the process of establishing what an autonomous AI agent is, who it acts for, what authority it’s been delegated, and who is accountable when it acts. Since then I’ve gone deeper*. This post is what I’ve learned, aimed at anyone responsible for running public services or an established commercial business. Sorry it’s so long. I’ve learned a lot.

Short version: people are starting to send software, not themselves, to deal with your organisation, and there are two questions your service needs to answer when it arrives. Right now it can answer neither.

Two questions, not one

Most conversations about “trusted agents” muddle two entirely different questions.

Question one: who sent this thing? Is this really an agent operated by the company it claims to come from, or is someone borrowing the name? A digital signature answers that, and the technology to check one at your front door already exists.

Question two: what authority does it carry? Did the actual customer or citizen ask it to do this particular thing? How much may it spend? When does the permission expire? Might it have been cancelled an hour ago? This is the genuinely new problem. The judgement isn’t whether a permission exists; it’s how far to trust what it says, for this exact action.

The questions don’t answer each other. Knowing who operates an agent tells you nothing about what a customer allowed it to do. And a permission, however genuine, tells you nothing about whether the software agent presenting it is still behaving. You need answers to both, and neither is enough on its own.

And actually, if you look closer, the two questions become six.

• Who runs this agent?
• Whose authority does it carry?
• What may it do?
• Is this specific action within those limits?
• What record will exist afterwards?
• How does the person challenge the result?

No single product, standard or register answers all six. That’s fine: each is answerable on its own, mostly with tools and open standards that already exist. (Give short shrift to anyone claiming they can answer them all at once. They can’t, and almost certainly won’t ever.)

Knowing who has sent you their agent doesn’t make it safe

I’ve written before about prompt injection: instructions hidden in a web page or email that hijack an agent. When it comes to AI Agents, this is a bit of a nightmare. A hijacked agent carries entirely genuine credentials. It really is the customer’s agent, with genuine permission. It has simply been talked into doing the wrong thing with it.

So identity checks may help you investigate damage after the fact, but they don’t prevent it. Prevention means applying something called ‘runtime limits’: rules your service enforces at the moment each request arrives. Permissions that expire quickly. Short lists of allowed actions. Caps on spending and frequency. A fresh “are you sure?” back to the person before anything unusual, deeply consequential or irreversible. A kill switch that works immediately. A receipt for everything.

The crucial word is “your”. These runtime limits live in your systems. A well-behaved agent stays within its instructions anyway; a hijacked one won’t, however sincere its operator. Enforce sensible runtime limits and you’re protected either way.

Here’s a diagram that tries to explain what happens when an AI Agent arrives at your service.

Isn’t it too soon to worry about AI agents? Nah. Think 2008, not 2012.

This feels like smartphones circa 2008. The iPhone existed. The direction was obvious to anyone paying attention. But the vast majority of traffic was still PC desktop, the app economy barely existed, and plenty said the iPhone was a toy for early adopters. Organisations that started rebuilding for mobile then looked over-eager for about three years, and then looked like geniuses. Organisations that waited until mobile traffic was undeniable spent the next decade retrofitting.

AI agents are at the toy-for-early-adopters stage, but I reckon AI Agents are going to be as big a deal as smartphones, and possibly bigger.

• They’re here, albeit in miniscule numbers. Shopping traffic arriving via AI services grew 4,700% year on year to July 2025. From a tiny base, mostly humans researching rather than agents buying, and converting worse than normal traffic.
• Big players are building the infrastructure. The payments industry isn’t waiting. Visa has run hundreds of controlled real-world agent transactions. Google’s AP2 and Mastercard’s Agent Pay show the shape of the thing: a signed record of what the person asked for, a tightly restricted payment token, a receipt. Cloudflare’s Web Bot Auth lets agent operators sign their traffic, and the IETF now has a working group standardising it.
• The analysts are all over them. (Yeah, yeah I know). Gartner says a third of digital interactions will start via an agent by 2028. A forecast, note. Not a measurement.
• Some vital UX stuff is as-yet-uninvented, not least for public services. A survey last month of 21 proposed permission systems found none that was easy for people to use, precise enough to remove ambiguity, and reliably enforceable by machines. Turning “find me these trainers under £70” into rules a computer can hold an agent to remains genuinely difficult.

The 2008 parallel holds for the plumbing too. Payments went first on mobile as well, because payment card networks had the incentives, the infrastructure and a mature process for arguing about who pays. Then the patterns spread everywhere. Expect the same here. Learn from payments, but test whether the ‘payments’ approach still works for housing assessments or benefit appeals rather than assuming it. It might well not. Some invention, market-shaping and standards-setting might be needed by those running public services.

And like 2008, the big risk isn’t today’s volumes. It’s that big organisations take five years to change and the adoption curve doesn’t care. The CMA wrote recently that most consumer AI agents are still on a short leash. But that’s a window in which to prepare, not a reason to relax.

Friction is dead. Deal with it.

I’ve banged this drum before, and in Computer Weekly: plenty of services quietly rely on people giving up. Agents don’t give up.

Making your service deliberately harder to use won’t save you. Agents chew through friction; the people without agents bear the cost. And inclusion cuts both ways: an agent could be transformative assistive technology for the carer who can’t spend a morning on hold or the tenant with limited English, yet capable agents could equally concentrate among the affluent while identity-heavy verification excludes anyone without conventional documents.

If tireless agents reveal that your service has been depending on people abandoning valid claims, that’s a policy choice arriving early: clarify eligibility, add capacity, reform the process, or change the policy. Blocking agents is not an honest substitute.

What I’d do this year

No big programme. But it does need a named owner, ideally someone with an ops, policy, tech and security view across lots of your services. They and a small cross-functional team should:

• Map the doors agents can already use. Anywhere software can read, submit, cancel, appeal, complain or pay, including the email inbox and the contact centre.
• Write your house rules. What proof will you accept, from whom, for which actions, and what happens to people who can’t provide it? Those are service and policy decisions, not something to leave to the security team.
• Scale the checks to the stakes. Looking up opening hours is not cancelling a tenancy. For information-only requests, normal traffic controls will do. For consequential ones: prove which agent, prove the approval covers this exact action, enforce the runtime limits yourself, issue a receipt, notify the person and give them a route to challenge.
• Test signed agent traffic at your front door. Ask your CDN/WAF suppliers what they can verify today. For some it’s a setting. For others, decidedly not.
• Try one narrow, revocable delegation on one real, reversible service. Publish what failed as well as what worked.
• Model demand. What happens if the effort of applying or appealing falls by half, or even to near zero? Pose that question to your policy and strategy colleagues, not just ops.
• Fix transparency and redress now. People should be able to see what their agent did, stop it, and challenge the result. None of that needs a new standard.

Public bodies: do this together. Dozens of Whitehall departments/ALBs and hundreds of councils inventing hundreds of incompatible rulebooks for how they handle AI Agents is simply unacceptable. Use One Login and the GOV.UK Wallet for what they actually do, which is helping a person prove something about themselves, ideally at the moment of confirming a high-stakes action. They are not a ready-made agent-delegation system.

The bit nobody has solved

A fair bit of wrangling, invention and standardisation is still going to be needed. Who pays when a consumer’s agent exceeds its instructions? What must a person be shown for their approval to count as informed? When one agent hands work to another, how do we make sure the permission gets narrower? How does a cancellation reach every system in the chain? Nobody knows yet. The first serious court cases will be highly instructive.

(And I might be wrong about all of this. Consumer agents may stay niche. Payments may be the exception rather than the template. A big platform may set the rules before open standards are ready. Fine. Those are reasons to test, measure and keep your options open, not reasons to wait.)

Leaders don’t need to pick the winning standard in 2026. They do need to decide the rules at their own front door, test them on real services, and work with peers on approaches that don’t belong to one supplier. That’s enough to begin.

Waiting for the market to hand you a finished answer is not a strategy.

It’s a non-trivial problem, is Know Your Agent. But a tractable one, if you start now.

Finally, I’ve used several of my LLM friends to help me draft a much more detailed briefing about how governments and other large organisations should prepare for AI Agents. Contact me directly if you want a copy.

* When I say I went deep in my research into KYA, I mean… I really went pretty deep. I started by asking three different, but highly capable LLMs to research AI Agents and KYA using a bespoke deep research skill that runs your research task through 5 personas (The practitioner, the academic, the sceptic, the economist and the historian). Which then got them all to do the synthesis, peer review, confidence scoring and draft a report with full citations etc, before getting them to challenge their own work. As a final step, I got the most powerful LLM I could find to act as the judge across the three other LLMs’ deep research reports. This LLM stage of research took a couple of hours and about £20. I then spent two days making sure I understood all this research and any LLM-derived conclusions from first principles, before deciding what I actually think and writing this blog post.