Rules written specifically for AI agents remain unfinished in both the US and the EU. But the access-control rules examiners already enforce cover agents today, and engineering teams can meet them now.
The security frameworks we built over forty years assume that some is behind the action. But agents break that assumption, and most enterprises haven't caught up.
