Forum: AI providers must make extent of agents’ access known to users

I refer to the article “Singapore authorities urge strict limits on AI agent autonomy, access to personal accounts” (Nov 6). The advice to limit an agent’s access is sound. But users need to know where that access begins.

The advisory from the Cyber Security Agency of Singapore, Government Technology Agency of Singapore and Infocomm Media Development Authority illustrates the problem. It says using Meta’s Muse with an account in the same Meta Accounts Centre as Facebook, Instagram or Threads automatically connects those accounts. Users who want them separate are advised to use another Meta account.

This is a wider question for artificial intelligence governance. If account links bring additional services within an agent’s reach, telling people to grant only necessary access is insufficient. Before an agent starts, providers should identify every account it will connect to, what it may read or do in each, and obtain a separate choice for each service. Adding an account later should require a fresh choice. Users should also be able to withdraw access from the connected service.

Singapore’s guidance asks people to draw careful boundaries. Providers must make those boundaries possible. A linked account is not permission for an agent to act.

Rohan Sharma