Gil Trachtenberg Would Like Your AI Agent to Show Some ID

Gil Trachtenberg is not a real person. He is, however, a composite drawn from real job postings, real organizational patterns, and real governance failures documented across the enterprise AI landscape in 2025–2026. If he reminds you of someone on your team, the one who keeps asking who owns the agent's credentials, that's the point. There are a lot of Gils now. AI governance postings surged 1,257% as organizations scrambled to meet EU AI Act deadlines, and 68% of the people filling these roles came from privacy, audit, or compliance backgrounds.¹

Before this role existed, Gil spent nine years in compliance operations at a large insurance company, where his job was making sure processes were documented, auditable, and owned by someone whose name you could find without sending four Slack messages. Eighteen months ago, he was hired as Agent Governance Lead at an enterprise software company. The title was partly his invention. HR didn't have a template for it.

The origin story, which Gil tells with the resignation of someone who's heard himself tell it too many times: he wrote an internal memo called "Our AI Has More Access Than Our Interns and Less Accountability." It went moderately viral on the company Slack. Two weeks later, he had a new job.

We spoke over video. Gil was in a glass-walled conference room designed for four people and currently holding Gil, a laptop, and what looked like a printed-out spreadsheet covered in highlighter marks. He apologized for the spreadsheet. "Credential audit," he said. "It's always a credential audit."

You've been in this role for about eighteen months. What did you think the job was when you took it, and what did it turn out to be?

Gil: I thought I was going to write policies. Here's the acceptable use policy for AI agents, here's the review framework, here's the escalation matrix. And I did write those things. They exist. They're in a SharePoint folder that I'm sure someone has bookmarked.

But the actual job, the thing I do every day, is making organizations admit what their workflows actually look like. Before you can govern an agent, you have to know what it's doing. Before you can know what it's doing, you have to know what the process is doing. And it turns out a terrifying number of processes exist as one person's institutional memory and a spreadsheet with conditional formatting that would make a grown engineer weep.

Can you give me a specific example?

Gil: Sure. Early on, we had a team deploy an agent to handle procurement routing. Straightforward stuff: take incoming requests, categorize them, route them to the right approver. The agent worked. It did the thing. Everyone was happy for about six weeks.

Then we did a quarterly access review and found the agent had read financial records it had no operational reason to touch. Not because it was doing anything sinister. It was running on a shared service account with broad permissions. The agent inherited the credentials of the person who set it up, and that person had access to half the finance stack because they'd been at the company for seven years and nobody ever scoped their permissions down.²

So the agent completed the task correctly while silently accessing data it shouldn't have seen. We only caught it because we were looking. I think about how many organizations aren't looking.

That sounds like an identity management problem more than an AI problem.

Gil: Thank you. That's what I kept saying, to rooms full of people who did not want to hear it. Eighty-eight percent of organizations have confirmed or suspected AI agent security incidents, but only 22% treat agents as independent identity-bearing entities.³ Most agents are still running on shared API keys or inherited user sessions. The agent doesn't have its own identity, so you can't scope its access independently from the human who launched it.

And here's the part that made me unpopular: fixing this meant going back to the team and saying, your AI assistant needs to become a credentialed process actor. It needs its own identity, scoped permissions, an expiration policy, and an audit trail that separates what the human requested from what the agent actually did.

People heard "your chatbot needs an HR file" and thought I was being obstructive.

Were you?

Gil: [Smiles.] A little. I was right, but I could have been right with better bedside manner. The thing I've learned is that governance people and engineering teams are having two completely different conversations. They're saying "this tool saves us forty hours a week." I'm saying "this tool made a decision that nobody authorized and nobody can reconstruct." Both things are true at the same time, and both people leave the meeting thinking the other one missed the point.

Was there a deployment that went well? Where governance wasn't the obstacle?

Gil: The coding agents. And not because code is simple. Because code already has a review path. You write code, it goes into a pull request, someone reviews the diff, tests run, CI gates pass or fail. The artifact is inspectable. Ownership exists. Rollback is a normal Tuesday. Microsoft published a study showing a 24% lift in merged PRs per engineer per day with command-line coding agents.⁴ That's real productivity. But the reason it worked isn't the AI. It's that software engineering already knew how to challenge a work product.

We saw the same thing in our security operations team. Incident response has categories, severity levels, evidence timelines, escalation procedures. When we put an agent on alert triage, it slotted into an existing accountability structure. The agent summarizes, enriches, drafts a timeline. A human reviews and decides. The review is meaningful because the reviewer knows what they're looking at and has opinions about it.

Compare that to the team that wanted an agent to "handle customer communications." Handle how? Approved by whom? Escalated when? They didn't have answers because the workflow had never been explicit enough to require them. The agent didn't create the ambiguity. It just made it impossible to ignore.

So agents are exposing process debt.

Gil: That's the diplomatic version. The less diplomatic version is that agents are exposing the fiction a lot of organizations tell themselves about how work gets done. You think you have a process. What you actually have is a person who knows where the exceptions live and has the good judgment to handle them quietly.

What keeps you up at night about this work?

Gil: [Long pause. He picks up the highlighter-covered spreadsheet, puts it back down.]

Whether the review is real. I've built these approval workflows where a human has to sign off before an agent takes a consequential action. And I'm proud of them, structurally. But I've read the research on automation complacency. Endsley and Kiris showed back in 1995 that passive supervision degrades the ability to intervene.⁵ That finding is thirty years old and we're still building systems that depend on the thing it says doesn't work.

That's a dark way to describe your own work.

Gil: It's an honest way. Some of what I've built is genuinely useful. The credential scoping, the identity separation, the audit trails that distinguish what the human asked for from what the agent did. That's real infrastructure, and it will outlast whatever we're calling these agents next year. But the human review layer? I'm not confident it scales the way we're pretending it will. And I don't have a better answer yet. If you have one, you have my email.

Gartner has suggested more than 40% of agentic AI projects could be cancelled by 2027.⁶ Does that feel right to you?

Gil: The number doesn't surprise me. What surprises me is the reason. It's not that the AI doesn't work. It's escalating costs, unclear value, and inadequate risk controls. The technology outran the organizational infrastructure.

But here's what I'd push back on: Gartner also said that applying the same governance controls to every agent regardless of autonomy level is itself a cause of failure.⁷ And I feel that one in my bones. I've spent eighteen months building a governance framework, and I genuinely don't know if I'm calibrating at the right level. Too uniform and I'm blocking useful agents with paperwork designed for dangerous ones. Too granular and I'm creating a patchwork of inconsistent accountability that nobody can audit, including me.

I described it to my boss as building the plane while flying it while also writing the aviation regulations. She told me to stop using that metaphor in front of the board.

Where do you think this is heading?

Gil: Eighteen months ago, teams came to me after something went wrong. Now they come before deployment. That shift is real, and I don't want to undersell it.

Whether it's enough, I honestly don't know. The permission infrastructure hasn't caught up to the deployment pressure. There are two IETF drafts trying to standardize how you bind a human's intent to an agent's action, and they're early-stage.⁸ The EU AI Act high-risk obligations take full effect in August 2026. Procurement teams are starting to ask for governance evidence before they'll sign contracts.

So the external pressure is building. The internal muscle is developing. But there's still a gap between what we can deploy and what we can govern.

I can answer those questions for about 60% of our agents right now. Ask me again in six months. I'll either be at 80% or updating my LinkedIn.

Footnotes

1. Axial Search 2026 analysis of 146 AI governance postings; IAPP data on privacy professionals handling AI governance duties. https://techjacksolutions.com/careers/ai-careers/ai-governance-lead/ ↩

2. This pattern, agents inheriting broad user credentials and accessing data beyond task scope, is documented across multiple 2026 enterprise security analyses. AGAT Software's State of AI Agent Security 2026 survey (N=900+) found that 45.6% of organizations still rely on shared API keys for agent authentication. https://arxiv.org/pdf/2604.06148 ↩

3. State of AI Agent Security 2026 report, survey of 900+ executives and practitioners. https://arxiv.org/pdf/2604.06148 ↩

4. Murphy-Hill, Butler, and Savelieva, "Adoption and Impact of Command-Line AI Coding Agents," July 2026. The authors caveat that merged PRs are a proxy for output, not delivered value. https://arxiv.org/abs/2607.01418 ↩

5. Endsley and Kiris, "The Out-of-the-Loop Performance Problem and Level of Control in Automation," 1995. ↩

6. Gartner, June 2025 press release on agentic AI project cancellation forecasts. Referenced in https://www.lumenova.ai/blog/ai-agent-security-controls-enterprise-scale/ ↩

7. Gartner guidance on proportional governance controls for AI agents at different autonomy levels, 2025–2026. ↩

8. Two 2026 IETF Internet-Drafts, the Human Delegation Provenance Protocol and the Intent Provenance Protocol, represent early attempts to standardize delegation binding for agent actions. ↩