Ian Rogers: Why Human Authorisation Will Define the Future of Agentic AI

 Digital Reviews Network thanks Ian Rogers, Chief Human Agency Officer at Ledger, for sharing his time and insights for this exclusive interview.

 

The recent compromise involving OpenAI employee credentials and Hugging Face infrastructure isn’t significant because of what happened today. It’s significant because it foreshadows a future where AI agents will increasingly have permission to act on our behalf.

The incident, while limited in scope, highlighted a growing reality: the ecosystem surrounding artificial intelligence is rapidly becoming part of the software supply chain, and therefore an increasingly attractive target for attackers.

But according to Ian Rogers, Chief Human Agency Officer at Ledger, the breach is less significant than what it reveals. As AI agents increasingly gain permission to act on behalf of users, the central challenge shifts from model capability to governance, authorisation and accountability.

“The problem isn’t that AI is becoming more capable,” Rogers told Digital Reviews Network. “It’s that we’re increasingly allowing capable, connected and probabilistic systems to take actions that require deterministic controls.”

The coming decade, he argues, won’t simply be defined by smarter AI. It will be defined by whether organisations can safely control what those AI systems are allowed to do.

Agentic AI is moving beyond information into action

The first generation of AI assistants largely answered questions, summarised documents or generated content.

The transition has happened remarkably quickly. ChatGPT answers questions. Microsoft Copilot drafts emails and documents.

Today’s AI agents have leaped from information to action, increasingly being connected to email inboxes, calendars, customer relationship management platforms, source code repositories, financial systems and enterprise applications. Rather than simply producing information, they’re being used to schedule meetings, write software, communicate with customers, execute workflows and make operational decisions.

That shift fundamentally changes the security challenge.

“Soon, there will be millions of AI agents connected to our email, calendars, financial accounts and enterprise systems,” Rogers said.

“What feels exceptional today will quickly become commonplace unless we build security into the architecture from the start.”

Why agentic AI needs a new security architecture

It took years for Zero Trust to become accepted as a foundational enterprise security model.

Zero trust solved who can connect.

Agentic AI is about who can act.

That is a fundamentally different security problem.

Unlike conventional software, large language models don’t operate deterministically. They reason probabilistically, interpreting context and generating likely responses rather than following rigid decision trees.

That flexibility is precisely what makes them powerful.

It is also why Rogers believes they should never become the final authority for sensitive decisions.

 

The real challenge isn’t AI intelligence — It’s authorisation

The distinction between intelligence and authority sits at the heart of the debate around agentic AI.

Large language models excel at reasoning through ambiguity, generating options and automating workflows. What they are not designed to do is determine whether a sensitive action should be allowed in the first place.

“The answer isn’t asking AI to supervise more AI,” Rogers said. “It’s separating reasoning from authorisation.”

Under that model, AI generates intent. Independent policy engines determine whether that intent falls within boundaries previously defined by humans. Only then should the action proceed.
Rather than embedding governance inside the model itself, Rogers believes organisations should place policy enforcement in an external deterministic system that AI cannot manipulate or reason around.

That distinction, Rogers argues, becomes increasingly important as organisations give AI greater autonomy.

 

AI governance depends on human-defined policies, not tasks

One of the more interesting misconceptions Rogers addresses is the idea that organisations should classify actions according to risk.

It might be tempting to classify certain actions as inherently “safe” and others as “high risk”. It’s an intuitive way to think about AI risk, but it isn’t how governance scales across an enterprise.

“The line isn’t drawn by the type of action,” Rogers explained.

“It’s drawn by a human, in advance.”

That means the same action might be autonomous in one organisation and require approval in another.

A calendar invitation may comfortably fall inside policy.

Routine procurement within a fixed spending limit may also proceed automatically.

An email drafted on behalf of an executive may require explicit approval every time.

The important distinction is not what the AI is doing.

It’s whether a human has previously authorised that behaviour.

“If an agent is sending an email as you, or accessing credentials, any action an agent takes, you must be able to know that a human authorised it, either through a policy or directly.”

 

Set policy once, then let AI operate autonomously

One criticism frequently levelled at secure AI architectures is that requiring human approval undermines automation.

At first glance, requiring human approval appears to undermine the promise of automation. In practice, the opposite may be true.

Rogers proposes that the goal isn’t continuous approval. It’s continuous autonomy within predefined boundaries.

Policies are established once.

Agents operate freely inside those policies.

Only exceptions return to a person.

“This is architecturally scalable,” Rogers explained.

“A human sets the policy once; within policy, the agent runs fully autonomously, all day long.”

“The approval step only surfaces for the exceptions.”

That approach may ultimately be the only practical way to deploy autonomous AI at enterprise scale.

 

Every computing revolution creates a new security boundary

History suggests that every major computing shift creates an entirely new security perimeter.

“The PC was about who gets to compute.”

“The internet was about who gets to publish and access information.”

“Crypto was about who gets to own.”

“Now AI is about who gets to act.”

“And every time, the pattern is the same.”

“We add capability faster than we add security.”

Rather than slowing AI adoption, this view argues that security architectures must evolve alongside model capability.

Otherwise, history simply repeats itself.

 

A four-layer architecture for separating reasoning from authority

That philosophy naturally leads to a four-layer architecture separating reasoning from authority.

Rather than allowing AI to independently decide whether actions are appropriate, the process should consist of four distinct stages:

• Agent identity – knowing exactly which agent is requesting an action. Who is acting?
• Agent intent – understanding precisely what the agent wants to do. What is being attempted?
• A deterministic policy engine – evaluating whether that action falls within previously authorised boundaries. Is it allowed?
• Proof of human – cryptographic evidence that a human authorised either the policy or the specific exception. Who approved it?

“The agent reasons and generates an intent,” Rogers explained.

“The policy engine checks it against approved boundaries.”

“If it’s outside those boundaries, it escalates.”

Proof of Human isn’t simply authenticating that a user exists. It’s cryptographic evidence that a specific sensitive action was authorised by a human at the moment it occurred. That distinction becomes increasingly important when AI agents are capable of acting continuously without direct supervision.

In traditional enterprise security, authentication usually answers whether a user is allowed into a system. Proof of Human instead answers whether a specific action was explicitly authorised by a person. As AI agents become capable of initiating thousands of actions autonomously, that distinction becomes increasingly important.

That separation allows AI to remain highly capable while ensuring sensitive decisions never rely solely on probabilistic reasoning.

 

Why identity alone isn’t enough for AI security

Many enterprise security platforms already provide identity management for users and applications.

Enterprise identity platforms already answer who or what is acting inside a system. What they don’t necessarily prove is whether a specific action was authorised at the moment it occurred.

“You need identity plus transaction-time security.”

Knowing which AI agent performed an action offers little reassurance if that agent itself has been manipulated.

Instead, organisations should be able to answer two simple questions after every sensitive transaction:

Who authorised this?

How can we prove it?

“If a CIO can’t answer those questions for every sensitive action an agent takes,” Rogers said, “they aren’t ready to give it access.”

 

The “lethal trifecta” that makes AI agents dangerous

The greatest risks don’t necessarily come from any single integration. They emerge when multiple capabilities converge inside one autonomous agent.

Rogers calls this the “lethal trifecta.”

An AI agent becomes significantly more dangerous when it simultaneously possesses:

• access to sensitive information
• the ability to communicate externally
• exposure to instructions originating outside its owner

Email perfectly demonstrates all three.

An inbox contains confidential information.

It allows communication with external parties.

Every incoming message potentially contains instructions written by someone else.

Connect that same agent to customer databases, financial systems or production infrastructure and the consequences expand dramatically.

“The integration itself isn’t the risk,” Rogers said.

“The risk is granting all three capabilities to one agent without a policy layer sitting outside it.”

Incidents involving compromised credentials or manipulated AI infrastructure demonstrate why concentrating all three capabilities inside a single autonomous agent dramatically increases the consequences of a successful attack.

 

Why AI governance must exist outside the mdel

Many organisations are attempting to solve AI governance by making models themselves safer. Rogers believes that starts in the wrong place.

“Don’t try to make the LLM understand governance or police itself.”

Instead, governance should exist in deterministic systems the model cannot influence.

Those systems should evaluate policy, authorisation and approval independently of the AI generating the request.

Attempting to solve governance by making models “safer” misses the underlying architectural issue.

 

Human agency must remain central to AI

Even Rogers’ job title reflects that philosophy — Chief Human Agency Officer.

Rather than focusing on artificial intelligence itself, his role centres on preserving meaningful human control.

“The title is deliberately not Chief AI Officer.”

Humans define objectives.

AI performs the middle of the workflow.

Humans approve the outcome.

“I think about it this way: AI is middle-to-middle and humans are end-to-end.”

In other words, AI should execute work.

Humans remain responsible for purpose and accountability.

 

Will future workplaces measure AI agents instead of employees?

Rogers expects autonomous AI to become commonplace rather than exceptional.

“Ten years from now we’ll be counting agents per employee.”

Just as computers quietly became universal workplace tools between the mid-1990s and early 2000s, he believes AI agents will become equally ubiquitous.

The question won’t be whether organisations use AI.

It will be how many specialised agents each employee coordinates.

 

AI will require a new form of digital literacy

The implications extend well beyond enterprise security teams.

Traditional cybersecurity education teaches people to identify phishing emails and suspicious websites.

AI shifts responsibility further upstream.

Just as users eventually learned to recognise phishing emails, they’ll increasingly need to understand what authority they’ve delegated to AI systems. Future security awareness training may focus less on suspicious links and more on understanding policies, permissions and approval workflows.

“The thing you need to get right is understanding what you’ve actually delegated.”

Most users today couldn’t explain:

• what permissions their AI assistant has
• what data it can access
• what policies govern its behaviour
• which actions require approval
• which happen silently

That knowledge, Rogers argues, will become the next essential digital skill.

An approval prompt displayed on trusted hardware should be treated with the same seriousness as signing a legal contract.

Increasingly, that’s exactly what it represents.

 

AI can reason. Cryptography must verify.

One of Ledger’s longstanding principles is that trust should be rooted in cryptographic verification rather than institutional trust.

According to Rogers, AI strengthens rather than weakens that philosophy.

“AI is probabilistic.”

“Blockchains, smart contracts and policy engines are deterministic.”

Rather than competing approaches, he sees them as complementary technologies.

AI excels at reasoning through uncertainty.

Cryptographic systems excel at enforcing rules and creating verifiable records.

“As agents take on more of the deciding, the need for an authorisation layer you don’t have to trust — only verify — only grows.”

 

Trusted hardware becomes the final security checkpoint

That philosophy naturally extends to hardware-backed authorisation.

“The only thing that actually works is seeing the transaction or the policy you’re approving on a secure screen, and approving it there.”

In Rogers’ vision, humans establish policies using trusted hardware.

AI agents then operate autonomously inside those boundaries.

Anything outside policy returns to a secure device for explicit approval — a device the AI itself cannot access or manipulate.

 

AI capability won’t be the surprise — security failures will

Asked what will surprise the industry most over the next five years, Rogers didn’t hesitate.

“The security failures.”

Model capabilities generally develop along expected trajectories.

Security failures emerge in unexpected ways.

“We’ve seen this pattern with every computing shift.”

“The failures are always more inventive than we expected.”

Unlike previous computing eras, however, AI failures won’t simply involve stolen information.

They may involve autonomous systems being manipulated into taking actions on behalf of people, organisations or governments.

That, Rogers believes, is why human authorisation is not a barrier to AI.

It’s what makes large-scale AI deployment possible.

“Verifiable authorisation isn’t a barrier to the agent economy,” he said.

“It’s the precondition.”

Across the enterprise AI industry, conversations are increasingly shifting away from model benchmarks and towards governance, accountability and trust. Rogers’ argument is that those challenges won’t be solved by more capable AI, but by architectures that keep human authority separate from machine reasoning.

The organisations that succeed may not be those deploying the smartest models. They will be the ones that can prove every autonomous action occurred within boundaries defined by humans.

 

Related reading: Yesterday we explored what enterprise leaders at 6DAI Melbourne identified as the biggest challenges to deploying AI beyond pilot projects. Ian Rogers’ perspective builds on that discussion by examining the security architecture needed when AI agents begin taking action on behalf of users.