The Next AI Problem Isn't Prompts. It's Permissions.

Microsoft is starting to talk about AI agents the way businesses should have been talking about them all along.

Not as chatbots.

As software that needs rules.

The company recently outlined Agent 365, a governance layer for managing AI agents across Microsoft and third-party tools. That sounds like the boring part of AI: permissions, security, controls, audit trails.

But boring is probably the point.

Most AI conversations still get stuck on prompts:

• Which model should we use?
• How do we get better answers?
• Should our team use ChatGPT, Claude, Gemini, Copilot, or whatever comes next?

Those are fine questions. But they're early AI questions.

The next question is simpler and more important:

What is this thing allowed to touch?

Chatbots answer. Agents act.

A chatbot can draft an email. You still decide whether to send it.

An agent might draft the email, choose the recipient, attach the file, send the message, update the CRM, create the follow-up task, and notify the team.

That is not the same problem.

It's not automatically dangerous. But it is operationally different.

Think about a normal employee. You don't give every new hire access to every bank account, client file, HR record, inbox, vendor contract, and admin setting on day one.

You give them access based on their role.

AI agents need the same treatment.

If an agent helps with client intake, maybe it can read form submissions and create a draft CRM record. Should it delete records? Probably not.

If an agent helps with billing, maybe it can flag overdue invoices and draft reminders. Should it issue refunds or change payment terms without approval? Probably not.

If an agent helps a legal team review documents, maybe it can sort files and identify deadlines. Should it email a client directly? Only if the firm has made that decision on purpose.

This is where AI gets practical fast.

The old problem was bad answers.

The first business concern with AI was accuracy.

Will it hallucinate? Will it make up a citation? Will it summarize this contract wrong? Will someone paste sensitive information into the wrong tool?

Those still matter.

But agents add a second problem: action.

A mistake doesn't just sit in a chat window. It can move into your systems. It can send the wrong message, update the wrong record, schedule the wrong appointment, or trigger the wrong workflow.

That doesn't mean agents are too risky to use.

It means they need boundaries.

A quick test

Pick one workflow where an AI agent might help.

Don't start with the tool.

Start with permissions.

Ask:

1. What information would the agent need to read?
2. What systems would it need to access?
3. What should it be allowed to create or update?
4. What should it never be allowed to do?
5. When should a human approve the action?
6. How would we review what it did later?

If you can't answer those questions, you're probably not ready to automate that workflow yet.

That's not a failure. It's useful information.

It means the next step isn't buying software. The next step is understanding the workflow.

The bottom line

Better prompts still matter.

But prompts aren't enough once AI moves from answering questions to doing work.

Before you ask what an agent can do, ask what it should be allowed to do.