Weekly signal

This week (Aug 24–Sep 1, 2026) saw concrete moves that push agentic AI from sandboxed helpers toward permanent pieces of employee toolchains — with immediate implications for employees’ daily work, privacy, and accountability. Key developments: Okta made agents first-class identities so enterprises can centrally manage and audit them; Thomson Reuters began shipping a proprietary legal model and agentic workflows that reframe tasks lawyers hand to junior staff; reporting on provider payment protocols and U.S. congressional attention highlighted gaps in proving what an agent was authorized to do; and NIST published guidance reinforcing agent identity and authorization as an operational requirement.

What changed

• Okta announced Agent SSO (general availability), treating AI agents as managed identities with lifecycle controls and admin visibility — meaning IT can now inventory, policy-govern, and include agents in regular access reviews the same way they do employees.

• Thomson Reuters launched its in-house model (Thomson) and rolled CoCounsel Legal updates that enable agentic, end-to-end legal workflows — framing agents as capable of producing work that previously required senior-associate oversight. This accelerates delegation of research and drafting inside law firms and corporate legal teams.

• Coverage of OpenAI’s push into “work” agents (desktop access to inbox/Slack and cross‑app automation) underscores the employee-facing tradeoffs: agents can materially reduce routine load but also require employees to grant access to private communications and applications.

• A Fortune analysis and the congressional record around the AI AGENT Act (S.5051) highlighted the practical accountability problem when agents perform financial or irreversible actions — and noted industry protocols (Google’s AP2) plus NIST activity as partial responses. Employers, workers, and payroll/finance teams face unresolved dispute-resolution and audit challenges for agent actions.

What to do with it

1. Inventory + ownership: treat agents like employees — add them to identity inventories, assign human owners, and include them in quarterly access reviews. Start with high-risk workflows (payments, HR, contract edits).

2. Pilot supervised delegation: for knowledge‑work (legal, finance, HR) run 6–8 week pilots where agents produce drafts in a flagged “staging” workspace and require explicit human sign‑off before publication or payment. Measure time saved, error rates, and rework.

3. Enforce task‑bound authorization for money/entitlements: require signed per‑task authorizations, short-lived credentials, and tamper‑evident logs for any agent that can spend or change entitlements — to align with emerging industry protocols and the direction of proposed law.

4. Update employee policies and training: add guidance about granting agents access to inboxes and internal systems, privacy expectations, and escalation paths for mistaken or unauthorized agent actions. Make review of agent outputs part of job descriptions where delegation occurs.

(See full briefing for context, implications and concrete next steps.)