AI agents, permissioning, and the next consent frontier
When software acts on a user’s behalf, yesterday’s cookie toggle is not enough. Agent permissioning needs purpose, scope, and revocation.
Privacy laws were written for organizations processing data about people. Agent-based products invert that: software requests permission to act as the person across services.
You still need a lawful basis, minimization, and logs. You also need scopes that expire, and a way for the human to revoke an agent without hunting through 20 OAuth grants.
Consent manager as policy runtime
The same engine that decides whether a tag may fire can decide whether an agent may read a preference or submit a privacy request. Start with explicit purposes and human-readable receipts.
Educational overview only — not legal advice. Confirm requirements with counsel for your products and markets.
