In 2026, Gravitee surveyed more than 900 security and engineering leaders for its State of AI Agent Security report. 88% of their companies reported a confirmed or suspected AI agent security incident in the past year. In the same survey, 82% of executives said their existing policies would prevent exactly that (Gravitee, 2026).
Meanwhile, operators keep debating one AI agent vs multiple agents: the god agent or the team. The host of the Agent Native podcast put the real worry to Vercel's CEO in one sentence: "I don't even want the marketing team to know about certain finance documents."
This post covers what Guillermo Rauch actually answered, the three permissions decisions his answer hides, and a worksheet to make those decisions for your own stack this week.
The short version: The one-agent-or-many debate hides the real decision: who sees what, from where, with what approval. Most teams skip that work. In 2026, Gravitee found 45.6% of companies still run agents on shared API keys, and only 21.9% give agents their own identity (Gravitee, 900+ respondents). Design the gate first. The architecture follows.
Why is "one agent or many" the wrong question?
Because the decision is already live, and the comparison framing can't settle it. In 2026, a Dataiku survey found 87% of global CIOs report AI agents already embedded in their stack (Dataiku, 2026). You're not choosing whether to have agents. You're choosing how to arrange the ones arriving anyway.
Search the question and you'll find dedicated comparison guides from Galileo, Redis, Dataiku, and half a dozen others. They weigh coordination overhead, task complexity, latency, cost. Every one ends in some version of "it depends," because they compare architectures in a vacuum.
The operators I talk to aren't stuck on coordination overhead. They're stuck on the thing the podcast host named: marketing and finance share a company, not a filing cabinet. A shared knowledge base sounds efficient right up until you list what's in it. Salary bands. Board decks. The churn spreadsheet nobody outside leadership has seen.
That's not an architecture problem. It's an access problem wearing an architecture costume.
So the debate stalls, the pilot stalls with it, and the mandate you were handed ("figure out agents") sits there aging. I've argued before that the shape of your stack decides the design. This is the sharpest case of it.
The one-versus-many debate misdirects operators. In 2026, 87% of global CIOs already report agents embedded in their companies (Dataiku survey), so the real decision is no longer agent count. It's access design: who sees what, from which channel, with which approval on writes.
What did Vercel's CEO actually answer?
Rauch runs an internal agent, called V, for a company of roughly 1,000 people. Asked the one-or-many question on the Agent Native podcast in August 2026, he described a router:
"When you have these intelligent agents they can act as routers. V, our internal agent, is a router. If you ask it about Vercel knowledge, it goes to the capability we have for looking up our documentation. If you need to help a customer with a support case, it has a support agent within it that has access to our support ticket infrastructure."
The host summed that up as the god model, and Rauch didn't push back. He compared it to a corporate phone: set up with your identity and a set of apps the day you join. One device. Many scoped rooms behind it. Then came the sentence that matters more than the architecture:
"What are the capabilities that we're bundling into this agent and also, crucially, how do we manage identity and who gets to access what information, which is also extremely business-specific."
Read that twice. He answers "one agent" for the experience, then spends the rest of the answer on identity and access. One front door for the user. Many scoped rooms behind it.
<figure> <svg viewBox="0 0 560 300" role="img" aria-label="Router agent diagram: one front door routes requests through an identity and channel check to three scoped sub-agents, each limited to its own data source" xmlns="http://www.w3.org/2000/svg"> <rect x="10" y="110" width="130" height="80" rx="8" fill="#4E79A7"/> <text x="75" y="140" text-anchor="middle" fill="#ffffff" font-size="13" font-family="sans-serif">One front door</text> <text x="75" y="160" text-anchor="middle" fill="#ffffff" font-size="11" font-family="sans-serif">Slack, email,</text> <text x="75" y="175" text-anchor="middle" fill="#ffffff" font-size="11" font-family="sans-serif">WhatsApp</text> <rect x="200" y="110" width="140" height="80" rx="8" fill="none" stroke="#F28E2B" stroke-width="2"/> <text x="270" y="140" text-anchor="middle" fill="currentColor" font-size="13" font-family="sans-serif">Router agent</text> <text x="270" y="158" text-anchor="middle" fill="currentColor" font-size="11" font-family="sans-serif" opacity="0.75">checks identity</text> <text x="270" y="173" text-anchor="middle" fill="currentColor" font-size="11" font-family="sans-serif" opacity="0.75">and channel</text> <line x1="140" y1="150" x2="200" y2="150" stroke="currentColor" stroke-width="1.5" opacity="0.6"/> <line x1="340" y1="150" x2="400" y2="50" stroke="currentColor" stroke-width="1.5" opacity="0.6"/> <line x1="340" y1="150" x2="400" y2="150" stroke="currentColor" stroke-width="1.5" opacity="0.6"/> <line x1="340" y1="150" x2="400" y2="250" stroke="currentColor" stroke-width="1.5" opacity="0.6"/> <rect x="400" y="20" width="150" height="60" rx="8" fill="#59A14F"/> <text x="475" y="45" text-anchor="middle" fill="#ffffff" font-size="12" font-family="sans-serif">Support agent</text> <text x="475" y="62" text-anchor="middle" fill="#ffffff" font-size="10" font-family="sans-serif">tickets only</text> <rect x="400" y="120" width="150" height="60" rx="8" fill="#59A14F"/> <text x="475" y="145" text-anchor="middle" fill="#ffffff" font-size="12" font-family="sans-serif">Data agent</text> <text x="475" y="162" text-anchor="middle" fill="#ffffff" font-size="10" font-family="sans-serif">warehouse only</text> <rect x="400" y="220" width="150" height="60" rx="8" fill="#59A14F"/> <text x="475" y="245" text-anchor="middle" fill="#ffffff" font-size="12" font-family="sans-serif">Finance agent</text> <text x="475" y="262" text-anchor="middle" fill="#ffffff" font-size="10" font-family="sans-serif">finance docs only</text> </svg> <figcaption>The router pattern described by Guillermo Rauch, Agent Native podcast, August 2026. One entry point, scoped sub-agents behind it.</figcaption> </figure> <!-- [UNIQUE INSIGHT] -->
Here's the move nobody in the ranking comparison guides makes: the router agent is an org chart for permissions. A router resolves the one-versus-many debate because it gives users a single front door while identity and channel decide which scoped sub-agent, and which data, each request can reach (Guillermo Rauch, Agent Native podcast, 2026). Both camps were right about the wrong thing. One agent wins the experience argument. Many agents win the access argument. The router is both, and the hard work is neither.
What are the three access decisions hiding inside the architecture question?
Every agent setup answers three questions, whether you designed the answers or not. In 2026, Gravitee found 45.6% of companies run agent-to-agent actions on shared API keys (Gravitee, 2026). That's the clearest sign most teams let all three answers happen by default. Rauch's own list from the episode: "the access control, the tools, the guard rails, the audit trails."
Decision one: identity. Who is asking? The person's role decides what the agent may retrieve for them. When an Acme Corp CS director asks about an account, the agent can pull billing history. When a contractor asks the same thing, it shouldn't. That only works if the agent knows who's asking, which is exactly what a shared API key erases. Only 21.9% of companies treat agents as identity-bearing entities today (same Gravitee survey).
Decision two: channel. Where are they asking from? The host of the episode spotted this one himself: "the agent would also be able to see where the message is coming from. So it's like, okay, if it gets sent in this channel it'll delegate to this sub-agent or access these certain files." Rauch's answer: "Totally." The finance channel routes to the finance sub-agent and its files. The marketing channel never sees them. Channel scoping is the cheapest access control you'll ever ship, because Slack already did the group membership work for you.
Decision three: action scope. What can the answer touch? Read, draft, or write-with-approval. Rauch again, describing the security model of an agent environment: "you define the tools, the human in the loop approvals and the data access controls for anything that the agent can do."
Each decision you make explicitly is an incident you don't spend a day untangling later. Palo Alto Networks found fragmented identity tooling adds an average of 12 hours to identity-related incident response (Help Net Security, 2026). Twelve hours is a sprint day. Per incident.
<figure> <svg viewBox="0 0 560 340" role="img" aria-label="Donut chart of how organizations authenticate agent-to-agent actions in 2026: shared API keys 45.6 percent, hardcoded authorization logic 27.2 percent, distinct identities per agent 21.9 percent, not reported 5.3 percent" xmlns="http://www.w3.org/2000/svg"> <g transform="rotate(-90 170 160)"> <circle cx="170" cy="160" r="80" fill="none" stroke="#F28E2B" stroke-width="44" stroke-dasharray="229.21 273.45" stroke-dashoffset="0"/> <circle cx="170" cy="160" r="80" fill="none" stroke="#4E79A7" stroke-width="44" stroke-dasharray="136.72 365.94" stroke-dashoffset="-229.21"/> <circle cx="170" cy="160" r="80" fill="none" stroke="#59A14F" stroke-width="44" stroke-dasharray="110.08 392.58" stroke-dashoffset="-365.93"/> <circle cx="170" cy="160" r="80" fill="none" stroke="#B0B7C3" stroke-width="44" stroke-dasharray="26.64 476.02" stroke-dashoffset="-476.01"/> </g> <text x="170" y="155" text-anchor="middle" font-size="22" font-weight="bold" fill="currentColor" font-family="sans-serif">45.6%</text> <text x="170" y="175" text-anchor="middle" font-size="11" fill="currentColor" opacity="0.75" font-family="sans-serif">shared API keys</text> <g font-family="sans-serif" font-size="12" fill="currentColor"> <rect x="330" y="90" width="12" height="12" fill="#F28E2B"/> <text x="350" y="100">Shared API keys: 45.6%</text> <rect x="330" y="120" width="12" height="12" fill="#4E79A7"/> <text x="350" y="130">Hardcoded auth logic: 27.2%</text> <rect x="330" y="150" width="12" height="12" fill="#59A14F"/> <text x="350" y="160">Distinct agent identities: 21.9%</text> <rect x="330" y="180" width="12" height="12" fill="#B0B7C3"/> <text x="350" y="190">Not reported: 5.3%</text> </g> </svg> <figcaption>How organizations authenticate agent-to-agent actions. "Not reported" is derived: 100 minus 45.6 minus 27.2 minus 21.9 equals 5.3. Source: Gravitee, State of AI Agent Security 2026.</figcaption> </figure>
What does the data say happens when you skip this design?
Machine identities already outnumber human ones 109 to 1, per the Palo Alto Networks 2026 Identity Security Landscape report (Help Net Security, 2026). Companies in the same report expect their AI agent identities to grow another 85% within twelve months. The group you're deciding access for is the fastest-growing one in your company.
Now put the confidence numbers next to the coverage numbers. In the 2026 Gravitee survey, 82% of executives felt confident their policies would prevent unauthorized agent actions, while only 47.1% of agent fleets were actively monitored or secured. A 34.9-point gap (82 minus 47.1). And only 14.4% of organizations had full security or IT approval for every live agent (same survey).
The audit picture repeats the pattern. Schellman's 2026 State of AI Governance survey asked 525 US professionals (fielded 13 April to 11 May 2026). 74% said they could pass an AI compliance audit today. Only 27% called their governance program fully mature (GlobeNewswire, 2026). US sample, worth noting if you're reading this from the EU. And more than half of companies can't enforce least privilege for service accounts across cloud, SaaS, and on-prem (Palo Alto Networks, same report).
<figure> <svg viewBox="0 0 560 380" role="img" aria-label="Grouped bar chart comparing perception and reality in 2026: 82 percent of executives confident versus 47.1 percent of agent fleets monitored (Gravitee), and 74 percent claiming audit readiness versus 27 percent with mature governance (Schellman)" xmlns="http://www.w3.org/2000/svg"> <g font-family="sans-serif" fill="currentColor"> <line x1="70" y1="310" x2="530" y2="310" stroke="currentColor" stroke-width="1" opacity="0.5"/> <line x1="70" y1="175" x2="530" y2="175" stroke="currentColor" stroke-width="0.5" opacity="0.2"/> <line x1="70" y1="40" x2="530" y2="40" stroke="currentColor" stroke-width="0.5" opacity="0.2"/> <text x="60" y="314" text-anchor="end" font-size="11" opacity="0.7">0%</text> <text x="60" y="179" text-anchor="end" font-size="11" opacity="0.7">50%</text> <text x="60" y="44" text-anchor="end" font-size="11" opacity="0.7">100%</text> <rect x="110" y="88.6" width="60" height="221.4" fill="#4E79A7"/> <text x="140" y="80" text-anchor="middle" font-size="13" font-weight="bold">82%</text> <rect x="182" y="182.8" width="60" height="127.2" fill="#F28E2B"/> <text x="212" y="174" text-anchor="middle" font-size="13" font-weight="bold">47.1%</text> <text x="176" y="332" text-anchor="middle" font-size="12">Agent security (Gravitee)</text> <text x="176" y="348" text-anchor="middle" font-size="10" opacity="0.7">confident vs monitored</text> <rect x="320" y="110.2" width="60" height="199.8" fill="#4E79A7"/> <text x="350" y="102" text-anchor="middle" font-size="13" font-weight="bold">74%</text> <rect x="392" y="237.1" width="60" height="72.9" fill="#F28E2B"/> <text x="422" y="229" text-anchor="middle" font-size="13" font-weight="bold">27%</text> <text x="386" y="332" text-anchor="middle" font-size="12">AI governance (Schellman)</text> <text x="386" y="348" text-anchor="middle" font-size="10" opacity="0.7">audit-ready vs mature</text> <rect x="110" y="10" width="12" height="12" fill="#4E79A7"/> <text x="128" y="20" font-size="11">What leaders claim</text> <rect x="280" y="10" width="12" height="12" fill="#F28E2B"/> <text x="298" y="20" font-size="11">What coverage shows</text> </g> </svg> <figcaption>Perception vs reality, 2026. Sources: Gravitee, State of AI Agent Security 2026 (900+ respondents); Schellman State of AI Governance (525 US professionals).</figcaption> </figure>
Don't read these as "AI risk" numbers. Read them as skipped-design numbers. Executive confidence in agent controls outruns real monitoring coverage by 34.9 points in 2026 (82% confident, 47.1% of fleets watched, Gravitee). In plain terms: most teams shipped agents first and designed access never. The same silence runs through the episode itself. I cover that in what 54 minutes on company agents never mentioned.
How do you design the gate for a team your size?
Start where Rauch's memory of early Vercel starts. "Most of the first 10 person team had read access to almost everything," he said, and a couple of people held write and admin (Agent Native podcast, 2026). That's the honest small-team baseline: broad read, narrow write. You don't need heavy identity tooling to copy it. You need a grid. And the growth numbers say draw it now: companies expect AI agent identities to grow 85% in twelve months (Palo Alto Networks, via Help Net Security, 2026).
<!-- [ORIGINAL DATA] -->
This is the exercise we run with clients, published in full because no comparison guide in the search results offers anything runnable. I call it the access map. Twenty minutes, three lists, one grid.
List your channels. Every place a request can enter: the Slack channels, the shared inbox, WhatsApp if you're honest about it.
List your data sources. CRM, billing, warehouse, the finance drive, the support desk.
For every channel-source pair, pick one action level. No access, read, draft, or write-with-approval. Every write gets a named human approver. Not a team. A name.
Filled in for a fictional Acme Corp (HubSpot, Stripe, a finance drive, a support desk), it looks like this:
Channel | HubSpot CRM | Stripe billing | Finance drive | Support desk |
|---|---|---|---|---|
#revops (Slack) | Read + draft | Read | No access | Read |
#support (Slack) | Read | Read | No access | Write, approver: Dana |
#leadership (Slack) | Read | Read | Read | Read |
Shared inbox | Draft replies, approver: Sam | No access | No access | Read |
Two rules make the grid trustworthy. Default every cell to read or below, and raise a single cell only when a workflow demands it. And if your data is regulated or finance-adjacent, narrow the read side too. Scope it by channel, the way the #leadership row is the only one that touches the finance drive.
Copy the grid into a spreadsheet and fill it in for your own stack. The blank version is the worksheet; the filled version is your architecture.
Microsoft's security team published the same pattern as formal guidance in July 2026: a unique identity per agent with a named owner, task-scoped roles, explicit tool allowlists, and end-to-end audit logging (Microsoft Security Blog, 16 July 2026). Good evidence the grid scales past the ten-person stage.
<figure> <svg viewBox="0 0 560 300" role="img" aria-label="Horizontal bar chart of expected 12-month identity growth in 2026: AI agent identities 85 percent, machine identities 77 percent, human identities 56 percent" xmlns="http://www.w3.org/2000/svg"> <g font-family="sans-serif" fill="currentColor"> <text x="10" y="30" font-size="12" font-weight="bold">Expected identity growth, next 12 months</text> <text x="145" y="83" text-anchor="end" font-size="12">AI agents</text> <rect x="155" y="63" width="323" height="34" fill="#F28E2B"/> <text x="486" y="85" font-size="13" font-weight="bold">85%</text> <text x="145" y="153" text-anchor="end" font-size="12">Machine identities</text> <rect x="155" y="133" width="292.6" height="34" fill="#4E79A7"/> <text x="455" y="155" font-size="13" font-weight="bold">77%</text> <text x="145" y="223" text-anchor="end" font-size="12">Human identities</text> <rect x="155" y="203" width="212.8" height="34" fill="#59A14F"/> <text x="375" y="225" font-size="13" font-weight="bold">56%</text> <line x1="155" y1="50" x2="155" y2="250" stroke="currentColor" stroke-width="1" opacity="0.5"/> </g> </svg> <figcaption>Expected 12-month identity growth by type. Source: Palo Alto Networks 2026 Identity Security Landscape, via Help Net Security.</figcaption> </figure>
Where does the human gate sit, and what makes it real?
A gate the reviewer can't inspect is not a gate. In February 2024, an employee at engineering firm Arup approved HK$200 million (about US$25.6 million) across 15 transfers after a video call with a deepfaked CFO (The Register, 2024). The approval step existed. It ran. It still failed, because the reviewer couldn't verify what they were approving.
That case predates agents, and that's the point. The failure mode isn't the technology asking for approval. It's approval without inspection. An agent gate is real when the reviewer sees the actual pending action, not a summary of it: the tool call, the record diff, the exact field changing from X to Y. And when every approval leaves a replayable record someone can audit later.
<!-- [PERSONAL EXPERIENCE] -->
Here's mine. My own HubSpot runs behind a coding agent with read access to everything and a hard human gate on every write. It can't change anything until I say yes. Mechanically, that means the write action arrives as a pending change I can read in full before it touches a record: which contact, which field, old value, new value. I wrote up the design in giving an AI agent write access to a production CRM.
Full disclosure, because this is where vendors usually blur: the step-level, replayable approval object we want (every approval stored as its own inspectable, re-runnable artifact) is designed, not yet built. Today my gate shows the pending change and logs the decision. The replay layer is roadmap, and I'd rather say so than imply it ships tomorrow.
None of this is an argument for autonomous agents. An agent acting without a reviewable gate is the risk, not the goal. Whose job the gate becomes inside your org is its own question, and I've kept it out of this post deliberately. It's covered in who should own agent governance.
So which architecture should you pick?
Pick the one your access map already drew. If every channel maps to the same data sources and the same approvers, one agent is fine, and adding more just adds coordination cost. The moment two channels must never see each other's sources, you have scoped sub-agents behind a router, whatever your diagram calls itself. The access map picks the architecture: uniform permissions favor a single agent, hard separations force a router with scoped sub-agents. That's the pattern Vercel runs internally for roughly 1,000 people (Guillermo Rauch, Agent Native podcast, 2026).
Five yes/no questions, straight off the grid:
Does any data source appear as "no access" for at least one channel? Yes means scoped sub-agents.
Do any two channels need different approvers for the same source? Yes means scoped sub-agents.
Is any source regulated or finance-adjacent? Yes means narrow read, scoped by channel.
Can every write action name its human approver? No means stop and fix that first.
Did every cell default to read or below? No means your map is aspiration, not architecture.
Redraw the map when a new data source lands, a new team forms, or a new regulation shows up. Notice what's missing from the checklist: model choice. Govern the work, not the model, and keep the human gate.
Want this built rather than debated? That's what our First Skill Sprint is: one broken workflow, one governed skill with the gate included, one to two weeks, fixed scope at a published EUR 8,000 to 12,000. Total price and a deliverable list, no day rates. If you're comparing partners for it, here's how to evaluate an implementation partner, with the questions I'd ask us too.
Frequently asked questions
Should a small team build one AI agent or several?
Start with one front door and broad read access, the way early Vercel did: "most of the first 10 person team had read access to almost everything" (Guillermo Rauch, Agent Native podcast, 2026). One agent works while your access map shows uniform permissions. Split into scoped sub-agents when two channels must not share sources.
How do I stop a marketing agent from seeing finance data?
Scope by channel and identity. Route the finance channel to a finance sub-agent that alone can reach finance files; the marketing channel never touches them. Avoid the common anti-pattern: 45.6% of companies still run agents on shared API keys, which erases who's asking (Gravitee, 2026).
What is a router agent?
One agent that knows who's asking and hands the task to a scoped specialist. Rauch's definition from the 2026 Agent Native episode: "V, our internal agent, is a router. If you ask it about Vercel knowledge, it goes to the capability we have for looking up our documentation." Support questions route to a support sub-agent with ticket access only.
Do AI agents need their own identities?
Yes. Only 21.9% of companies treat agents as identity-bearing entities today (Gravitee, 2026), and Microsoft's July 2026 guidance recommends a dedicated identity with a named owner per agent. Without its own identity, you can't scope an agent, watch it, or revoke it on its own.
The part worth remembering
The architecture debate resolves itself once access is designed. Uniform permissions: one agent. Hard separations: router plus scoped sub-agents.
Three decisions do the real work: identity (who's asking), channel (where from), action scope (read, draft, or write-with-approval).
Every write action gets a named human approver who can inspect the actual pending change. An approval step without inspection moved US$25.6 million at Arup.
The numbers say most teams ship first and design never: 88% reported incidents, 45.6% still share API keys, 47.1% of fleets monitored.
Draw the grid this week. If the access question is blocking a specific workflow, bring us that one workflow. The discovery call is free, you talk to Ranya, and if we're not the right fit we'll say so and point you somewhere better.
And if you think the god agent camp or the multi-agent camp has this right after all: tell me where I'm wrong.
