What happens when an AI agent is no longer just your assistant, but a teammate working across your organization? And what if that agent was built by someone else?

Most platforms treat AI agents as applications acting on behalf of a user, inheriting their identity and permissions. This works for simple use cases, but breaks down when agents operate autonomously, collaborate across teams, and connect from external platforms. Who owns the agent? What can it access? And who is accountable when something goes wrong?

At monday.com, where we're building a future in which humans and AI agents work side by side, these challenges pushed us to rethink our identity and permissions architecture.

In this session, we'll share how we're evolving our platform to treat AI agents as first-class identities, with their own permissions, access boundaries, and audit trails. We'll dive into the architectural challenges of supporting both native monday.com agents and external agents built on third-party platforms, while maintaining enterprise-grade security and governance.

Through real engineering challenges, architectural decisions, and lessons learned, we'll explore what it takes to move beyond user impersonation and build the foundation for trusted human-agent collaboration at enterprise scale.

Key Takeaways:

* Why traditional permissions break: How inherited user permissions create security risks, unpredictable access, and accountability gaps as agents become autonomous.

* Agents as first-class identities: Designing dedicated agent identities, scoped permissions, provisioning, and auditability.

* Bring Your Own Agent/Key (BYOA/BYOK): How to securely integrate external and customer-built agents into enterprise workflows without compromising control.

* Engineering for enterprise scale: Architectural patterns and lessons for building secure, governed, and scalable human-agent collaboration.

Session presented on WeAreDevelopers, North America 26' - https://www.wearedevelopers.com/world-congress-north-america/speakers/dor-cohen