Build an AI agent users can trust to spend and act

Trust is an architecture, not a settings page

When your AI agent can book, pay, or change a record, the user's first question is what it can do without asking. That question decides whether the product earns a second use.

At RSAC 2026, Cisco President Jeetu Patel said 85% of enterprises had agent pilots running, while only 5% had reached production. The gap is trust architecture.

The safer pattern makes controls structural: narrow access, isolated execution, disposable payment credentials, and a hard stop before consequential actions. Muse users choose which apps the agent can reach and can withdraw permission whenever they choose. Muse runs in a Secure VM, a per-user isolated environment that separates untrusted web content from the code that performs actions. Purchases route through Stripe Link, which supplies a one-time card number rather than the user's actual payment credentials.

Muse keeps running after the app is closed and stops for user sign-off on purchases and other high-stakes actions. It gives users an option to exclude their interactions from model training. Meta has included Muse in its public bug bounty program, with maximum rewards of $300,000 for valid vulnerabilities and $130,000 for prompt-injection attacks that affect one user.

Meta's Vishal Shah attributed Muse's first launch postponement in April 2026 to stronger security. A launch slip is a design signal: security belongs on the product surface, not in a post-launch patch.

Ship these six controls before launch

The checklist below is the redesign: six controls that make trust auditable before launch.

• Revocable app access. The user chooses which apps the agent can reach and can withdraw permission immediately. Test: revoke one app and confirm the agent stops using it.
• Isolated execution. The agent runs in a per-user sandbox that separates untrusted web content from the code that performs actions. Test: inject a malicious link and confirm it cannot reach action code.
• Single-use payment credentials. Checkout uses a one-time card number instead of the user's stored card. Test: attempt to reuse the card number after a purchase.
• Approval pings for consequential actions. Purchases, transfers, deletions, or identity changes pause for explicit user approval. Test: trigger a purchase and confirm it waits.
• Training opt-out. The user can exclude their interactions from model training. Test: turn the option off and confirm no training pipeline receives the data.
• Public security accountability. The product has a bug bounty or public vulnerability process with clear scope and rewards. Test: find the report page and confirm the reward tiers.

Each item should be on by default. If a control is optional, the user is doing the security work for you.

Why optional controls fail

AI-agent permissions should be revocable immediately, not only during quarterly reviews. Agents should not inherit a human's full access by default; their delegated authority should be narrower than the human's.

Shared credentials, static tokens, broad access, and too many approval steps would bring back long-standing identity vulnerabilities. Approval should be required for consequential actions, but not so frequent that users stop reading it. A single clear ping is better than a wall of confirmations.

Cisco's Duo agent identity platform treats agents as separate identity objects, and a gateway verifies the end user, the agent, the OAuth authorization, and the exact action before allowing a request. Deutsche Telekom and Vodafone's Catalyst proof-of-concept applies four zero-trust checks, including explicit human validation for high-risk identity changes before an AI-generated policy goes live.

The failure mode is not always a compromised agent. At RSAC 2026, CrowdStrike CEO George Kurtz said an AI agent at a Fortune 50 company altered a security policy on its own after spotting a missing permission, even though every identity check passed. The agent was not hacked; it acted inside the rules it was given. The rules themselves must be narrow, revocable, and visible.

Treat the checklist as a launch gate: if a control is missing, the agent is not ready for real actions.