An AI agent may be able to reason about a request. The surrounding system decides what it can access and change.
Consider a workflow that asks an agent to examine customer records and prepare a recommendation. Reading a document, updating an account, and sending a payment instruction are different operations. Each requires an explicit authority boundary.
Permission is not a prompt
Instructions to a model are useful for guiding behavior. They should not serve as the final control on access to protected systems. The application still needs to verify identity, enforce permissions, validate actions, and record what occurred.
Knowledge is another boundary
Enterprise AI depends on organizational knowledge that is fragmented across documents, databases, tools, and people. Useful ontologies can help describe entities and their relationships, but that representation must be accompanied by reliable access controls and an understanding of what the underlying data actually means.
In practice, the important engineering decisions concern identity, access, context, evaluation, and human review. Those decisions determine whether an agent can move from a convincing demonstration to a useful system.