Having spent 10 years building AI products, this resonates a lot. Machine learning has long been a black box. Now we’re giving a much more capable black box access to our most sensitive data and the ability to act on our behalf. Alignment is still a huge challenge. We may never fully understand why a model made a particular decision or which training data shaped it. We need guardrails around it that hold even when the model gets things wrong. An email agent can have read-only access: it can summarize your inbox, but it has no permission to send anything. Through Entra ID, an agent acting on your behalf stays within explicitly granted permissions and your existing access. These boundaries need to be enforced outside the model. Same for action logs, spending limits and the ability to stop it mid-task. “Don’t do this” in a prompt is a request. Removing the permission is a control.