Before You Ask What an AI Agent Can Do, Ask Who It Is
CIO, Friday, October 16th, 2026
Valimail's co-founder proposes a DMARC-style 'agent passport' to verify which organization owns an AI agent before granting access.
Non-human identities outnumber humans 45 to 1 in enterprises and 144 to 1 in cloud-native environments, and 68% of security professionals can't tell legitimate AI agents from malicious ones.
The author argues that before setting permissions, organizations must ask whose agent it is and whether they trust its owner.
Drawing on how DMARC used DNS to fix email sender spoofing, he proposes an agent 'passport' based on domain-anchored trust that proves an agent's provenance, plus a 'visa' that defines what it may do in a given system.
That way, agents claiming to represent a vendor can be checked automatically and at scale.