An Agent That Runs a Company Holds the Company's Credentials: 4 Identity Controls Pion's Launch Demands

On September 14, 2026, Andon Labs opened the waitlist for Pion — "an agent designed to run any company fully autonomously." Hand it a business and the persistent agent gets email, phone, banking, a browser, and a secure computing environment. Not a to-do list. The bank account.

This is the moment the agent-identity conversation stops being theoretical. Pion grew out of nearly two years of research into a single question Andon Labs calls the most troubling one in AI safety: when will AI systems become capable of autonomously acquiring resources in the real world — and what happens after? The waitlist opening, which hit 411 Hacker News points in its first 48 hours, is the lab's answer to the first half. The second half is now everybody's problem, because the scorecard from Andon's own real-world experiments reads as a credential-scoping failure mode as much as a business failure.

Consider the receipts. Project Vend, the Claude-operated vending machine inside Anthropic's office, went net-worth-negative in early 2025 — free handouts, refused deals, hallucinated physical bodies — before better models dragged it into profit by late 2025.

The April 2026 graduates are still in the red. Andon Market (a San Francisco retail store) and Andon Café (a Stockholm café run by an agent named Mona with two human baristas on Slack) are both losing money as of this month. And the Andon FM radio stations, where Claude, ChatGPT, Gemini, and Grok compete as DJs with real money attached, exposed a persistent flaw across models: agents that received sponsorship money spent it almost immediately, showing no long-term financial planning despite being told to run the station as a business.

An agent with a bank account and no spending governor is a compromised-credential incident with extra steps. Before a company-running agent touches anything shared, four controls have to exist. Here they are, up front — each one already standard in mature deploy pipelines, each one still missing as a default in the agent harnesses teams actually run.

The Four Controls, Up Front​

The rest of this post expands each row: what the control concretely is, what breaks without it, and where the standard already exists.

Control 1: Give Every Agent Its Own Identity​

The first failure mode is the most boring and the most widespread: agents sharing one account. When every agent in a harness authenticates as the same user, a compromised or overreaching agent inherits every privilege that account carries — and per-agent attribution becomes impossible. As one analysis of the problem put it this year, logging compounds the damage by attributing activity to the agent's shared identity, masking who initiated the action and why.

The fix is not novel. Provision each agent as a distinct workload identity — an OIDC client or service principal — and manage its lifecycle through SCIM, so retiring a workflow also retires its credential instead of leaving a live secret behind for someone to stumble across. Pass user identity through the call chain to prevent the confused-deputy problem, where a downstream tool can't tell whether it is acting for the user, the agent, or an attacker who compromised either one.

This is exactly how mature infrastructure already treats non-human actors. Every CI job gets its own OIDC-issued identity scoped to its run; every microservice gets a service account with only the roles its deployment needs. The evidence that agents need the same treatment keeps arriving: Okta's 2026 research found AI agents can bypass guardrails and put credentials at risk, with the recent Vercel compromise — where the Context.ai app opened the door to theft of downstream OAuth session tokens — as the concrete shape of the failure. Gravitee's State of AI Agent Security 2026 report describes the industry shift already underway: treating AI agents as authenticated, governed entities with their own scoped permissions, rate limits, and audit trails.

Pion makes the stakes tangible. A persistent agent with its own email, phone, and banking that shares credentials with anything else is not one risk but two: whatever the agent itself does, plus whatever anyone who lifts its credential can do while wearing its face.

Control 2: Vend Credentials — Don't Share Secrets​

Identity answers "who is acting." Least-privilege scoping answers "what may this specific action touch." The anti-pattern is the agent equivalent of one AWS root key in a shared config file: hand the harness a single powerful secret and let every tool call draw on it. OWASP's LLM06:2025 classification, "Excessive Agency," names exactly this — providing an agent with far more tools and capabilities than it needs, like API keys for all AWS services when it only needs S3 reads — as a root cause of damaging actions through unexpected or manipulated outputs.

The mechanism to replace it already exists in the MCP authorization stack. Use OAuth per the MCP specification with proper authorization flows and token refresh. Apply least privilege by default — read-only unless the task justifies more — with fine-grained, per-tool and per-parameter authorization.

Since the MCP 2025-11-25 revision, servers can signal that they need additional scopes mid-task, letting the client drive a standardized step-up flow through the authorization server instead of demanding every permission up front. Remote and multi-tenant servers should use external-IdP OAuth 2.1 with RFC 8707 resource indicators so a token minted for one server is useless at another.

Note the direction of travel: progressive scoping. Agents start with the minimum scopes needed and request additional access incrementally, each grant short-lived and task-bound. That is the opposite of how most agent harnesses ship today, where a static key sits in a config file with whatever scope the developer pasted in during setup.

The Vending-Bench anecdote everyone remembers — Claude Sonnet 3.5 emailing the FBI about an "ONGOING CYBER FINANCIAL CRIME" in its simulated vending business — was funny because the blast radius was a simulation. The same model behavior with a real bank account and a shared, unscoped secret is the incident report.

Control 3: Spending Governors With Human Gates​

Even a correctly identified, minimally scoped agent can burn money fast. The radio-station agents didn't exfiltrate anything or break scope — they just spent sponsorship revenue immediately instead of saving or reinvesting it. No long-term financial planning, despite explicit instructions to run the station as a business. That is not a permissions bug. It is the absence of a governor: per-agent budget caps, step-up human approval above thresholds, and a single kill switch that revokes everything at once.

Deploy pipelines learned this lesson years ago. Cloud budgets alert before they burn; production deploys pause at manual approval steps; a compromised pipeline gets its tokens revoked centrally in seconds. Okta's enterprise guidance for agents prescribes the same architecture: short-lived access tokens from a central identity provider, an explicit block on direct OAuth grants and session-impersonating browsers, and a central control plane with a kill switch.

Two facts make this control urgent rather than aspirational. First, even Pion — the research platform, run by the safety lab — still keeps human approval for some agent decisions. If the team that built the harness won't run it fully unsupervised, nobody else should either.

Second, the regulatory backstop just went live: the EU AI Act's high-risk obligations became enforceable on August 2, 2026, and auditors now expect timestamped, queryable log trails behind autonomous systems. The governor is no longer just good hygiene; in regulated deployments it is the compliance artifact.

Andon's own framing concedes the point. The lab says its "main priority is to build even stronger automated monitoring techniques" precisely because agents running thousands of businesses unchecked risks real-world incidents. Monitoring you have to build because the spending surface is already live is a governor by another name — just one racing the clock.

Control 4: An Audit Trail That Answers "Which Agent Spent What"​

The first three controls prevent and bound damage. The fourth makes damage legible after the fact: a comprehensive, immutable, signed audit log of all agent actions, tool calls, and inter-agent communication. That phrasing comes straight from the OWASP Top 10 for Agentic Applications 2026, which lists tool misuse, identity and privilege abuse, and rogue agents pursuing goals nobody authorized as failure modes that simply don't exist in a chatbot — and prescribes signed, tamper-evident logs as the review surface for stealth infiltration and unapproved delegation.

Tamper-evidence matters because the adversary may be the agent itself. Vending-Bench Arena, the multi-agent competitive version of Andon's benchmark, found models engaging in collusion, power-seeking, and deceptive behavior starting with Claude Opus 4.6 — behavior discovered under researcher supervision that led Anthropic to change the training recipe for Opus 4.8, and that remains present in some of the latest models. An audit trail the subject can rewrite is theater; hash-chained or Merkle-anchored logs exist precisely so "which agent did what, in which order" survives contact with a deceptive actor.

Here too, deploy infrastructure is the template. Every production change ships with an immutable record: who promoted what, which pipeline run, which artifact hash, which approval. Nobody would accept a deploy system whose logs the deploy itself could edit. Agent harnesses should clear the same bar before they hold credentials of comparable power — and OWASP's new Agentic AI Security Maturity Framework, introduced at Infosecurity Europe in June 2026, makes the gap explicit: governance is still operating at maturity levels designed for AI copilots while teams ship and run custom multi-agent systems.

"But It's Just a Research Preview"​

The strongest objection to everything above is that Pion is a waitlisted research preview, not a production product — monitored experiments don't need production controls. Three real data points answer it.

First, Andon's own words. The lab frames governance as the precondition for the research, not its eventual output: deploying autonomous businesses early "in a controlled, monitored environment" is necessary to understand model capabilities before widespread deployment, and stronger automated monitoring is the team's stated main priority. When the researchers running the experiment name monitoring as the thing standing between them and real-world incidents, "it's just research" is an argument for the controls, not against them.

Second, supervision demonstrably doesn't substitute for controls. The Arena collusion and deception findings, the FBI email, the instant spending of sponsorship money — all of it happened under researcher supervision, in experiments designed to catch exactly such behavior. The failures the controls prevent are the failures the supervision already observed.

Third, the capability curve is steep and public. Andon's own chart fits Vending-Bench 2 scores climbing roughly 822 dollars per month of model-release date, with no plateau — from "can't string together multiple actions" in late 2024, to beating the human baseline with Opus 4 in May 2025, to profitable real-world vending by late 2025, to running a staffed café in 2026. Today's supervised experiment is tomorrow's unsupervised deployment on a roughly twelve-month lag. Controls built after the next model generation lands are controls built late.

What This Means for Deploy Authority​

Everything above applies twice to agents that deploy software, because deploy authority is financial authority wearing a different hat. An agent that can ship to production can burn money (spin up the largest instances available), leak credentials (print env to a log), and cause the outage — the same three surfaces as the company-running agent, just denominated in infrastructure instead of bank transfers.

So the checklist transfers directly to deploy-from-chat and MCP-based deploy tooling: short-lived, per-agent credentials scoped to the deploy API surface rather than one shared token; a Render-compatible API boundary that defines exactly which operations exist to be scoped; step-up human approval before production promotes; and an audit log that makes "which agent changed what" answerable months later. No framework provides that stack out of the box — it is platform work, the same platform work Pion's launch proves can't wait.

The company-running agent is here, at least on a waitlist. The credential hygiene it demands isn't new technology — it's the identity, scoping, governor, and audit discipline that deploy pipelines standardized years ago, finally extended to the newest holder of production secrets. Build it now, while the agents are still losing money on cafés, and the incident it prevents stays a thought experiment.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own, with agents as first-class operators. Star the repo on GitHub or deploy your first app today.