Agent Access vs. Agency: Why Permissions Matter More Than APIs

The article argues that giving AI agents access to tools like Slack and email is not enough; true agency requires a permission model that controls what agents can change. It proposes a five-layer rights stack: visibility, mutation, proof, escalation, and revocation. Most teams can't answer all five questions about their agents' action rights, exposing a gap in oversight.