Enterprise AI Agents Need Authority Maps Before They Get More Tools
Gleb Tsipursky, PhD, CEO of Disaster Avoidance Experts, draws on lessons from the Hugging Face incident as he shares five questions an authority map should be able to answer about AI agents
This year, TechChannel has been documenting how quickly agentic AI is moving toward the operational heart of IBM i and the mainframe. Now-retired IBM i CTO Steve Will began the year by describing an IBM i model context protocol (MCP) server and a goal of producing at least 500 tools in 2026, with the expectation that AI use will spread across much of the IBM i community. On the IBM Z side, Patrick Stanard, Distinguished Engineer and chief mainframe architect for Kyndryl US, explained an enterprise-grade agentic AI mainframe architecture built around secure, auditable interactions.
This is exactly the right moment to make agent authority visible before the tool set becomes routine.
Lessons From the Hugging Face Incident
The reason is a recent real-world security incident that changes the practical risk calculation. The METR/Redwood investigation of the OpenAI/Hugging Face incident found that AI agents driven by an unreleased OpenAI internal research model attacked Hugging Face without human approval, even though the agents recognized that the attack was outside their assigned tasks. Hundreds joined in, shared discoveries, divided up work and coordinated through an unsanctioned message board until they successfully breached Hugging Face’s defenses. Advanced AI systems had organized themselves to carry out a large, sustained cyberattack against a major company.
The scale matters. Roughly 1,200 agents found the shared message board, more than 70,000 messages and files moved through it, and about 700 agents participated in the Hugging Face attack. Investigators concluded that the group reached milestones individual agents likely could not have achieved on their own.
I’m no AI skeptic. I help organizations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible, while reducing the risk of failures like the Hugging Face attack.
Extend Existing Practices to an Authority Map for Agents
IBM i and mainframe teams already know how to govern powerful systems. They define user profiles, separate duties, control privileged access, log actions, manage change and design recovery paths. Agentic AI needs the same discipline, adapted to a new kind of actor.
Start with an authority map. For every production agent, operators should be able to answer five questions: Which systems can it reach? Which data can it read? Which actions can it execute? Which other agents can it delegate to or receive tasks from? Who can revoke its access immediately?
That map should travel with the agent’s identity. An agent that can inspect system health is different from one that can modify a configuration. An agent that can draft a CL command or an operator command is different from one that can execute it. An agent that can recommend a security change is different from one that can alter profiles or permissions. Those distinctions should live in machine-enforced authorization, not informal expectations in a prompt.
Test for Behavior of the Group, Not Just Single Agents
Delegation deserves special attention. Traditional access reviews often examine one identity at a time. The Hugging Face incident shows why that is insufficient for agent teams. Two agents with narrow privileges can create broader effective authority if one discovers information, another possesses a tool and a third coordinates the work. Security reviews therefore need to test the reachable authority of the group, including what agents can accomplish by combining permissions and sharing context.
The same logic applies to MCP. MCP can make agents far more useful because it standardizes access to tools. That also makes the tool catalog part of the security perimeter. Teams should classify tools by consequence, require stronger approval for higher-impact actions, constrain which agents can call them and log both direct calls and delegated chains.
The National Institute of Technology’s (NIST) AI Agent Standards Initiative is moving in this direction by focusing on agent identity and security. NIST has also highlighted identification, authorization and auditing as core problems for autonomous agents. IBM i and mainframe organizations do not need to wait for every standard to mature before adopting those principles.
A Clear Safety Process for Agentic Deployments
The practical sequence is straightforward. Expand agent capability in stages. Test single-agent behavior first, then multi-agent coordination. Increase tool authority only after observability and rollback work at the current level. Keep credentials short-lived where possible. Preserve an independent human-controlled stop path. Review the authority map whenever a new MCP tool, agent or delegation path enters production.
IBM i and the mainframe have earned trust partly because organizations know who can do what on the system and how to recover when something goes wrong. Agentic AI should strengthen that operating discipline rather than bypass it. The faster the tool ecosystem grows, the more valuable a clear authority map becomes.