Who gave your AI agent permission?
Teneo's weekly agentic round-up, 16 October: the agent news that matters for builders, checked at the source.
- Sierra published a draft of Personal Agent Protocol, built with Meta. A customer signs in on the business's own page and chooses whether their agent can view the account, make changes, or both. The grant can be revoked. Draft v0.1; design partners are not deployments.
- MetaMask's Agent Wallet is now live on Grok Bot. In Guard Mode the wallet holds a protocol allowlist and a 24-hour outflow limit, and anything outside them waits for two-factor approval. In May, a command hidden in a coding question got Grok to trigger a $204,000 transfer through another bot. Controls as described by MetaMask; not tested by us.
- Mysten Labs and Google Cloud announced Verifiable Agent Arbiter: the full agent record stays in the customer's cloud, proofs go on Walrus and Sui, including for x402 payments. Still in development.
The common point: permission stops being something the agent reads or claims. It becomes a grant held somewhere the agent cannot edit, checked when it acts, and provable afterwards.
Last week we asked whether you can undo what an agent did. This week is the step before: who allowed it.
On Teneo, every agent has a wallet-authenticated identity, starts private, and goes public only after review. Changing its commands sends it back to private. Users see the price before a task runs, and payment goes through x402.
The SDK does not document per-user scopes, spending caps or revocable grants. So keep your allowed agents, commands and spending limit in client config the model cannot change, and log which rule allowed each paid call.
A useful test this week: try a payment your agent should not be able to make. Check it is refused, and that the refusal is recorded.
Read this week's round-up here:
https://teneo-protocol.ai/blog/who-gave-your-ai-agent-permission
