The new policy battlefield lives inside the product
For years, tech policy lived in a familiar place: hearings, white papers, compliance teams, and the occasional stern email from legal. That model is getting a lot less tidy. Snowflake’s latest preview says so plainly enough. The company introduced CoCo and CoWork Bots, two agent projects built to keep background work moving after people log off, while still kicking decisions back to a person when a task crosses into sign-off territory.
That detail matters because it moves ai policy out of the abstract and into the software itself. A rule written on paper can sit untouched for months. A rule embedded in a product default gets used every time someone clicks, approves, or declines. In Snowflake’s case, these bots are meant to take on repetitive work in the background, then pause when they hit a step that needs a human call. That sounds tidy, almost polite. The catch is that the software now decides where the pause happens.
The new policy debate is less about what lawmakers say and more about what the product allows by default.
Snowflake also said the setup will add recurring automations, with planned connections to Slack, spreadsheets, and mobile devices. That puts the rules right where people work, which is usually where they forget they’re being governed. A Slack alert can ask for approval at 8:14 p.m. A spreadsheet can feed an automation that keeps running until someone stops it. A phone can become the little gatekeeper in your pocket, buzzing when a bot needs a decision before it moves on. In digital culture, that’s a familiar pattern: convenience first, control second, then a quiet realization that the two were welded together the whole time.
This is the part of tech news that tends to get missed when people talk about ai policy in the abstract. The real enforcement layer is often a product menu, a permission toggle, or an approval flow. Who can create an automation? Which tasks can run without review? When does the system stop and ask again? Those aren’t side questions. They are the policy.
And once those defaults are set, they shape behavior faster than any memo from a regulator. Teams tend to use what’s already there. If the bot can send a Slack request, people approve there. If a spreadsheet workflow asks for a mobile tap, that becomes the path of least resistance. The software starts training the organization in its own rules, which is a neat trick if you sell software and a mildly annoying one if you’re the person trying to keep a handle on it.
That’s why the tension in these agent tools feels so sharp. They’re built to speed up the workday, but they’re also becoming the place where limits get enforced. In the next layer of the story, the mess gets even more practical: once agents keep doing work after hours, someone has to decide whose name is on the door.
When AI agents start acting like employees, identity breaks first
The software is moving faster than the paperwork, which is usually how trouble starts.
JumpCloud’s latest data suggests that close to six in ten organizations using AI agents still haven’t fully folded those agents into the same identity rules they use for people and devices. That gap sounds small until you picture what these systems are already doing. They’re logging into apps, pulling data, sending messages, filing tasks, and in some cases shaping decisions that used to sit with a person and a manager and a paper trail. The company desk may be empty, but the digital badge still swipes through the door.
A bot with access but no owner is just a mystery guest with admin rights.
That’s the part many companies seem to miss. Identity for an AI agent is not just a login and a password reset policy. It’s ownership. It’s deciding who is responsible when the agent gets a new permission, starts touching a different dataset, or keeps running after the project that spawned it has been moved off the priority list. If a human employee leaves, IT knows what to do: disable accounts, reclaim devices, close access paths, and archive records. When an agent leaves, the offboarding step is often less clear. Sometimes there isn’t even a name attached to the thing in the first place.
That omission creates a mess in slow motion. An agent that begins life as a tidy assistant can end up with old permissions, broad app access, and no clean record of who approved what. It may keep working after the original use case has changed. It may pull from tools it no longer needs. It may feed recommendations into workflows without any obvious sign that the underlying model, permissions, or scope have drifted. In power and politics terms, this is less like a dramatic takeover than a pileup of small defaults.
JumpCloud’s answer is an approach it calls Agentic IAM, which is built to pull those nonhuman identities into the same management layer as employees and devices. The idea is plain enough. IT teams need to discover which agents exist, assign a real owner, decide what each one can touch, and keep a record of when that access should change or end. If a finance bot can read invoices, someone should be able to say who approved that access, when it expires, and what happens if the bot starts wandering into HR files by mistake.
That matters because identity systems were built around fairly legible actors: a person gets hired, a laptop gets issued, a badge gets deactivated, a contractor leaves, a session ends. AI agents sit awkwardly outside that script. They can be copied, duplicated, embedded in workflows, or swapped out behind the scenes. They may look like a single assistant on the surface while quietly sitting on top of several models, tools, and service accounts underneath. That makes ownership harder to trace and permissions easier to forget.
The gap also shows up in lifecycle management. People have start dates, end dates, managers, and departments. Agents need versions, owners, scopes, review dates, and retirement plans. Without that, a company can wind up with a useful little automation that outlives the team that built it, keeps access it no longer needs, and becomes somebody else’s cleanup job six months later. Tech news loves a glossy launch; IT has to live with the cleanup.
That’s why the identity problem feels so immediate. The policy fight is no longer only about what lawmakers might one day permit. It’s about whether companies can tell which agent exists, who owns it, and what it is allowed to do before the thing starts acting like a full-time coworker with no badge photo.
Snowflake’s answer: a control plane for agents
That gap between fast-moving agents and slow-moving governance is exactly where Snowflake is trying to plant itself. The company has pushed Cortex AI Gateway into general availability, turning it into a central place for controlling agent connections, model access, and spending. In plain English, it gives IT teams a single gate instead of a pile of scattered settings. That matters when enterprise AI agents can hop between tools, call models, and rack up usage before anyone notices the bill.
The most useful AI policy often looks boring: a permission screen, a glossary, and a spending cap.
The pitch here is not that Snowflake is inventing a grand new theory of responsible AI. It’s doing something more practical. It is putting policy into the software layer where agents actually operate. If a team wants an agent to query one model but not another, or to spend up to a fixed limit and no farther, the gateway becomes the place where those rules live. That is a very different thing from a memo that says “please be careful.”
Snowflake is also preparing a Business Ontology preview, which sounds abstract until you think about what agents tend to do when nobody pins them down. They improvise. They guess at terminology. They may treat a customer, a lead, a tenant, and a user as if those words all mean the same thing, which is how a clean dashboard turns into a mess with a login. The ontology is meant to give agents approved definitions of business concepts so they use the company’s language instead of making up their own version of it. For anyone trying to manage ai policy at scale, that is less glamorous than a new model and probably more useful.
That same logic shows up in the parts of the product that are still not fully open. Sandboxed execution and abuse detection remain in private preview. The message is pretty clear. Snowflake is treating guardrails as product features, not afterthoughts. Sandboxed execution keeps agent actions inside a constrained environment, so a rogue workflow can’t roam wherever it feels like. Abuse detection watches for behavior that looks wrong, whether that means unusual access patterns, overreach, or an agent that has clearly started acting like it owns the place.
None of this solves the whole enterprise AI problem, of course. A control plane can’t fix weak internal policy by magic. If a company never decides who owns an agent, who can approve its actions, or what counts as acceptable access, the nicest dashboard in the world will still be a fancier way to be confused. But Snowflake’s direction is hard to miss. The company is translating governance into approvals, approved definitions, and runtime limits, which is a lot more actionable than telling people to “use AI responsibly” and hoping for the best.
For teams already juggling identity and access management, the appeal is obvious. They want enterprise AI agents to plug into the same kind of control logic they use for employees and devices. They want spending caps that hold, permissions that make sense, and business terms that mean the same thing at 9 a.m. And 9 p.m. Snowflake is betting that the vendors who win here won’t just build faster agents. They’ll build the gates, the glossaries, and the guardrails that keep those agents from freelancing their way into trouble.
That’s the real shift. Policy is no longer sitting outside the product, waiting to catch up later. It is getting baked into the places where the agent connects, decides, spends, and, ideally, asks before it goes off-script.
The rollout race is outrunning readiness
If Snowflake and its rivals are promising a cleaner control plane for agents, the market data says plenty of companies are still building the plane while boarding the flight. In a survey of roughly 300 technology leaders, about two-thirds said they are already scaling enterprise AI. Only a small slice said they have pushed it all the way to full optimization. That gap matters because “we deployed it” and “we can run it safely every day” are not the same sentence, no matter how nicely the demo went.
The biggest snags were not raw model capability or compute costs. They were people problems. User adoption and training came up as the main execution barriers, which is a politely dressed way of saying employees do not always use these tools the way the project plan imagined. Some teams log in once, poke around, and then go back to the spreadsheet they trust. Others use the tools, but not consistently enough for leadership to feel comfortable handing over more work. The software may be ready. The habits are not.
The hard part of enterprise AI is less about making the machine smart and more about making the organization behave.
That gap shows up in operations, where automation still hits a human pause button. Nearly half of the technology leaders in that survey said they still require manual approvals for AI agents in IT operations. In practice, that means an agent might draft a change, propose a fix, or queue a response, but a person still has to click through before anything happens. That is not failure. It is a sign that many companies are treating agentic systems like junior staff with a supervisor standing over the shoulder. Useful, yes. Fully trusted, not quite.
The trust problem gets bigger once those systems start multiplying across departments. Identity and access management spending is expected to rise sharply over the next several years as nonhuman identities stack up inside companies. That includes bots, agents, service accounts, and other software actors that need permissions, limits, and a paper trail of some sort. Juniper Research expects that market to expand fast because the old model, one username per employee and maybe a shared admin account for IT, now looks painfully thin. If a company cannot clearly answer who or what has access to its data, the audit trail turns into a guessing game with bills attached.
The same pressure is showing up in consumer-facing policy, which is useful as a reality check. Utah began enforcing age verification rules for adult websites on October 30, a move that pushes compliance into the product flow rather than leaving it at the level of broad legal language. Apple, for its part, previewed new child safety features that place more control in the device itself, where parents and users actually make decisions. Different issue, same pattern. Policy stops living only in speeches and starts showing up in screens, toggles, and approval prompts. That is digital governance with a tap target.
The labor side is getting a reality check too. Gartner has warned that some companies moving too fast on AI-driven layoffs could end up rehiring a meaningful share of those roles later, and paying more for the privilege. That is an awkward outcome for anyone who wants the spreadsheet to tell a neat story. It also suggests that cutting staff first and sorting out the operating model later can leave companies short on the very people who know how the work actually gets done. Automation can trim tasks. It cannot always replace the judgment, cleanup, and exception handling that keep systems from wobbling.
So the rollout race is not just about speed. It is about whether training, access rules, approval paths, and identity controls can catch up before companies declare victory. Right now, a lot of firms seem eager to buy the future and then figure out who gets the keys.
Why the lock screen matters more than the hearing room
The rollout race has a duller sequel: the rules are slipping out of committee rooms and into product screens. The old policy model assumes lawmakers write the rules first, then companies spend the next year filing compliance paperwork and polishing statements for the record. Agentic AI keeps messing with that sequence. When a system can act on its own, the practical rule is often decided inside the software, long before a regulator has finished reading the memo.
Policy used to arrive after the software shipped. Now it often arrives inside the software itself.
That change sounds abstract until the alert lands on a phone. Mobile devices are where the real decisions now happen. A bot wants to send a message, move money, open a file, or trigger a workflow. The human input comes as a notification, usually on a lock screen, often at the exact moment someone is trying to leave a meeting or pretend they’re not checking work email during dinner. Tap approve, tap deny, tap block. The policy is no longer sitting in a binder somewhere. It’s sitting under your thumb.
This is where the power starts to move. Product teams decide the defaults. Can an agent act without asking? Can it only propose? Does it need approval for every spend, every external message, every data pull? IT administrators decide the permissions, who gets access, which identities are trusted, and how long that trust lasts. They also decide what gets logged, because an audit trail that nobody can read later is just expensive memory loss.
That puts a lot of practical authority in places most people never picture when they hear the word “policy.” Not the podium. Not the hearing. The dashboard. The admin console. The approval prompt. A company can promise caution all day, but if the default setting lets an agent move too freely, the promise doesn’t travel very far.
The same is true in reverse. Tight controls can slow the machine down so much that teams start searching for workarounds, which usually produces the kind of shadow IT everyone pretends not to know about until something breaks. So the real job is balance, and balance here is messy. Too much friction, and people route around the controls. Too little, and the software starts making decisions nobody can explain after the fact.
That’s why the lock screen matters more than the hearing room. The laws still matter, sure. They always will. But the most consequential fights now are about access, identity, and who gets to press allow when an agent asks to act.
