Blyde Financial Services, a fictional South African financial-services group, now has an AI landing zone. Its models are approved, its prompts are versioned, its evaluations gate releases and its spend is attributed per team. The collections team wants to go further. Customers who fall into arrears often call when they are already in distress, and advisers spend most of each call gathering information: balances, payment history, previous arrangements, notes from the last contact and the hardship options the customer qualifies for.
The proposal is an arrears-support agent. It would retrieve that evidence, draft options for the adviser and customer, book callbacks, open hardship cases and prepare payment-arrangement proposals. It would not change credit terms or send a binding decision without an authorised person approving it.
Every one of those verbs is an action in a business system, and that is the line this part is about. An AI landing zone governs intelligence. An agentic landing zone governs authority. The AI landing zone answers "is this model fit to produce this output?". The agentic landing zone answers "may this agent, acting for this person, do this thing, now, and who will answer for it?".
What changes when the system can act
A summarising model that produces a bad answer creates a bad document, and a person usually reads it before it matters. An agent that books the wrong arrangement, emails the wrong customer or opens a case against the wrong account has changed the world. The cost of an error moves from the quality of an output to the consequence of an action.
Three things follow, and none of them is a model problem.
- The agent needs its own identity. Otherwise its actions are logged under a shared service account or, worse, under the adviser's name.
- Its authority must be granted per action and must expire. What it can technically do through its tools is not the same as what it is permitted to do. Agent capability is not agent authority sets out that distinction, and this part turns it into shared infrastructure.
- Every material action needs evidence and an accountable owner. That means a record of who acted, for whom, under which grant, with what inputs, and who approved it.
If each agent team builds these for itself, Blyde will have the four-pilot problem from part 7 again, with higher stakes. The agentic landing zone makes them shared services.
The layers most agent diagrams leave out
Most agent architecture diagrams show a model, a prompt, some tools and perhaps a vector store. The layers that make an agent safe to run in a regulated business are usually missing. Blyde's reference architecture puts them in the middle.
Seven layers carry the weight.
- Agent identity. Each agent has its own identity, separate from users and from generic service accounts, and a named human sponsor who answers for it.
- Policy enforcement. Every proposed action is checked against policy in code before any tool runs, not by asking the model to behave.
- Credential brokering. The agent holds no standing secrets. A broker issues a short-lived credential scoped to the approved call.
- Human approval. Material actions wait in a queue for a named person with the authority to approve them.
- Durable state. Progress, pending approvals and decisions survive restarts and long waits. An agent without durable state cannot own a long-running process explains why.
- Observability and evaluation. Every step is traced, and agent behaviour is evaluated on whole tasks, not just single model calls. A trace is not an evaluation separates the two.
- Incident containment. A kill switch, credential revocation and quarantine can stop one agent, or all of them, without a code release.
Two supporting services complete the picture. The first is a tool and MCP registry that records which tools exist, who owns them and which agents may use them. Why an internal MCP registry needs ownership covers the ownership model. The second is an agent gateway at the edge. AI gateway, API gateway and agent gateway explains how its job differs from the model gateway's.
Agent identity is now a platform capability
Until recently, agent identity usually meant a shared app registration with too many permissions. On 7 November 2026 all three major clouds document a dedicated construct. Their status should be checked again before you design around them.
- Microsoft. The Microsoft Learn "What's new in Microsoft Entra Agent ID" page describes Agent ID as generally available. It documents agent identity blueprints, owners, sponsors and managers, access packages for on-behalf-of and autonomous scenarios, sponsor lifecycle workflows that prevent orphaned agents, and Conditional Access templates for agents. Some features on the page, such as the blueprint creation wizard, are still marked preview, and licensing for some agent controls should be confirmed separately.
- AWS. Amazon Bedrock AgentCore Identity implements agent identities as workload identities, with inbound authorisers and outbound credential providers for reaching other services on a user's behalf.
- Google Cloud. Agent identity for Vertex AI Agent Engine gives each agent its own SPIFFE-based IAM principal, tied to the agent's lifecycle, that can be granted or denied access like any other principal. The page did not state a launch stage when we checked it, and Google's agent platform release notes list the related Agent Identity API as Preview (18 June 2026).
Standards work is following. NIST's National Cybersecurity Center of Excellence published a concept paper on software and AI agent identity and authorisation in February 2026. It explores how existing standards such as OAuth 2.0, OpenID Connect and SPIFFE could apply to agents.
The landing-zone rule at Blyde is simple: no agent reaches production without its own identity and a named sponsor, and no agent acts under a person's identity. When the arrears agent works for an adviser, the record shows both the agent and the adviser. That is what lets an auditor tell the difference between "the adviser did this" and "the agent did this for the adviser".
Authority is delegated, scoped and time-limited
Identity says who is acting. Authority says what it may do. Blyde records each agent's authority as a grant with five parts:
- Actions. For example, book a callback, open a hardship case or prepare an arrangement proposal.
- Scope. Only the accounts of the customer in the current interaction.
- Limits. For example, arrangement proposals below a set threshold, or no more than one outbound message per case per day.
- Duration. The grant lasts for the session or the case, not forever.
- Sponsor. The business owner who approved the grant.
The agent cannot widen its own grant, and a grant that is not renewed lapses. The authority ladder from read to write describes how an agent earns more authority over time. The landing zone's job is to make the current rung enforceable.
The decision path runs in code, before any tool call. First, identify the agent and the person it acts for. Then check the action against the grant and route it by risk tier. Low-risk actions, such as booking a callback, run and are recorded. Material actions, such as proposing a payment arrangement, wait for a named adviser to approve them. Prohibited actions, such as changing credit terms, are refused and logged. All three paths write the same evidence record.
Credit decisions in South Africa carry legal obligations, and a hardship conversation with a customer in distress carries conduct expectations. Deciding which actions are material or prohibited is therefore a legal and compliance decision as well as an architectural one. This article is general information, not legal advice.
Policy before action, credentials per call
Policy enforcement and credential brokering are where an agentic landing zone either exists or does not.
Policy lives outside the agent, at the point where tool calls leave the runtime. AWS, for example, made Policy in Amazon Bedrock AgentCore generally available in March 2026. It evaluates agent-to-tool calls against rules written in the Cedar policy language at the AgentCore Gateway (checked on 7 November 2026). The product matters less than the placement: a policy engine the agent cannot edit, evaluated on every call. The gateway is a control point, not a trust boundary explains why that engine must not be the only control.
Credentials are issued per call by a broker, scoped to the approved action and short-lived. The arrears agent never sees a database password or a long-lived API key. If it is compromised, the attacker inherits a credential that expires in minutes and covers one customer's case. Containment is an architecture feature covers the wider set of controls that limit what a compromise can do.
Approval and durable state
Human approval is only a control if it is designed as one. At Blyde an approval request shows the adviser the proposed action, the evidence the agent used, the grant it is acting under and what will happen if they approve. The approver's identity and decision are written to the same record as the action. Comments are not approval describes what that record needs.
Approvals take time. An adviser may be on another call, and a hardship case may wait days for documents. The agent's state, including pending approvals, therefore lives in durable storage that survives restarts and deployments. An approval that arrives after a restart must resume the right step, once.
Observability, evaluation and containment
The agentic landing zone records every step: the request, the context retrieved, the plan, each proposed action, the policy decision, the approval and the outcome. That trace is the evidence for audits and complaints. It is not, on its own, proof that the agent is good at its job. Blyde evaluates the arrears agent on whole cases from a labelled set, measuring whether the options it proposed were the ones a skilled adviser would have offered.
The OWASP Top 10 for Agentic Applications, published by the OWASP GenAI Security Project on 9 December 2025, is a useful check on the design. Several of its categories map directly to layers in this architecture:
- ASI02 tool misuse maps to the registry, the grant and policy before action.
- ASI03 identity and privilege abuse maps to agent identity and credential brokering.
- ASI08 cascading failures and ASI10 rogue agents map to containment.
Containment is the layer teams forget to test. Blyde's kill switch can stop one agent or all agents, revoke their credentials and quarantine in-flight actions without a deployment. It is pulled in a test every quarter, because an untested kill switch is a hope, not a control.
What the arrears agent may do
The table is Blyde's illustrative internal design. It is not a statement of what South African credit law or conduct rules require or permit, and a real institution should have its legal and compliance teams set these boundaries.
| Action | Authority | Control |
|---|---|---|
| Retrieve balances, history and previous notes | Allowed, read-only, current customer only | Grant scope and data-product access policy |
| Draft hardship options for the adviser | Allowed; draft only | Evaluation on labelled cases |
| Book a callback | Allowed; low risk | Policy check and evidence record |
| Open a hardship case | Allowed within limits | Policy check, durable state |
| Prepare a payment-arrangement proposal | Requires adviser approval | Approval queue with evidence shown |
| Send a binding decision to the customer | Not delegated; a person sends it | Refused by policy |
| Change credit terms or limits | Prohibited | Refused and logged; alert to sponsor |
Key points
- An AI landing zone governs intelligence. An agentic landing zone governs authority.
- Give every agent its own identity and a named sponsor, and never let it act under a person's identity. Microsoft, AWS and Google now all document agent identity constructs; check their status on the day you design.
- Express authority as a grant with actions, scope, limits, duration and a sponsor, and enforce it in code before any tool call.
- Keep policy outside the agent and issue credentials per call through a broker.
- Design approval as a control with evidence, and keep agent state durable.
- Trace everything, evaluate whole tasks and test the kill switch.
This is part 8 of Cloud Foundations, Explained End to End. Previous: What is an AI landing zone?. Next: One enterprise, four landing zones
How CloudNala can help
CloudNala designs agentic landing zones for organisations that are about to let agents act in business systems. We define the identity and sponsor model, the authority grants and risk tiers for each action, and the placement of policy enforcement and credential brokering. We also design the approval records, durable state, tracing and containment controls. Then we test them with you on one real agent, so that authority is enforceable before the agent is trusted to use it.
Background reading: Microsoft, What's new in Microsoft Entra Agent ID; AWS, AgentCore Identity; Google Cloud, Agent identity for Agent Engine; NIST NCCoE, Software and AI agent identity and authorisation concept paper; OWASP GenAI Security Project, Top 10 for Agentic Applications.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book a Landing Zone Review or write to us at consult@cloudnala.co.za