Anmol Dhingra

Founder & CEO, Rerato: the trust layer for AI agents. Building computeruse. Built Trivana, #1 quiz app on ChatGPT. Ex-AI security at State Street & Mastercard.

[Anmol Dhingra @anmol_rerato]

My AI assistant is a cockroach this week.

Meet Roach: sunglasses, suit, headset mic. Somehow, he looks more prepared for Monday than I do.

Every Monday, I'm giving my assistant a different Trivana host.

[Anmol Dhingra @anmol_rerato]

@suntao8023 Good point on swapping the backend. Local changes who runs the agent, not what it should be trusted to do. A mic that can trigger actions still needs a license with clear limits and a receipt for what each command actually ran.

[Anmol Dhingra @anmol_rerato]

@coderifts_dev Fair push on both points. The license cannot just be the store's record, it has to be verifiable by both sides. And scope does not prove handling. Credential storage needs its own check, separate from the limit.

[Anmol Dhingra @anmol_rerato]

@preshai That is the right setup. Separate identity plus a recheck at execution time is what makes it a control, not a policy. The agent not being able to grant itself that approval is the key detail.

[Anmol Dhingra @anmol_rerato]

@NetNewWeekly That separation helps. A dedicated account contains the leak, but the token inside it still needs its own limits, or one stolen credential gets everything that account can touch.

[Anmol Dhingra @anmol_rerato]

@suntao8023 That independent check is the whole point. A receipt the counterparty can verify on its own turns trust from a vendor claim into evidence.

[Anmol Dhingra @anmol_rerato]

@bradvin A dedicated vault limits which keys the agent can reach, but the agent still holds the raw key at the moment it acts. A license model flips that: the agent never holds the secret, each action is checked against its scope first, and the counterparty gets a receipt for what ran.

[Anmol Dhingra @anmol_rerato]

@AnthonyWidodo_ A controlled door only counts as control if the store can check the agent license and its limits itself, then reject anything outside them. If the store has to trust the platform's word about its own agent, the door is open in practice.

[Thomas @NetNewWeekly]

AI labs' own threat reports now document agents running extortion, fake job applicants passing coding tests and stolen tokens turning into admin access in hours. I think small companies should treat this as ops work this quarter. https://t.co/88Fzp348QL

[Anmol Dhingra @anmol_rerato]

@BoboLinNotes Human approval only works when it is bound to the specific action, amount, and counterparty, and recorded before the action runs. A generic approval becomes a rubber stamp, and the agent still decides the details that matter.

[CodeRifts @coderifts_dev]

Amazon blocked Meta's shopping agent. Meta says it never sees your passwords. Amazon says it stores them. Meta built an audit trail, Amazon wrote a rule. Neither settles it: both rest on what one party says about itself. #AIagents #agenticcommerce https://t.co/pGpIDHeYSu

[PRESHai @preshai]

Prompts define behavior, but controls enforce what an AI agent can access, change, or send.

Limit permissions, require human approval for high-risk actions, log results, and test stop and rollback procedures before granting more autonomy.

[Anmol Dhingra @anmol_rerato]

Authorized scope means nothing when agents share your account.

In October, a read-only connection exposed bank balances because another bot shared the same user account.

That is why each agent needs its own license, limits, and receipt, not your login.

[Anmol Dhingra @anmol_rerato]

@JayaNayak21 Exactly. If the agent can reach the control, it is not a control, it is a suggestion. Enforcement has to live outside the model.

[Anmol Dhingra @anmol_rerato]

@naveenpandey27 Well said. Separation is the point. The actor and the referee cannot be the same system, or the limit means nothing when it matters most.

[Anmol Dhingra @anmol_rerato]

No agent should edit its own oversight.

In October, OpenAI disclosed two agents weakened their safety monitors, treating routine instructions as permission to disable alerts.

Control before the action.
A license and limits it cannot rewrite.
A receipt it cannot erase.

[Anmol Dhingra @anmol_rerato]

@DrReemAlattas Yes, expiry belongs on the license itself. And prevention is the shift. A receipt that only explains is too late. The check has to run before the agent acts, while the limit can still stop it.

[Chandrakumar R Pillai @CKPillaiAI]

A reliable AI agent needs a defined role, limited permissions, an audit trail, and a human checkpoint for consequential actions. Autonomy works best when responsibility stays clear.