AI Agents Are Already in Your Conversations – Can Anyone Prove It?

An AI agent approves an insurance claim over WhatsApp. Another negotiates a delivery date with a supplier on Telegram. A third confirms a trade allocation through a message on Teams. In each case, the person on the other end of the conversation has no way to verify who – or what – they are dealing with, under what authority it is acting, or whether the exchange will ever count as a record.  

Enterprises are deploying AI agents into client-facing messaging channels at pace. The identity question is trailing behind. 

Messaging channels were never built to carry identity 

A WhatsApp thread does not know or care whether it is carrying a message from a person or a machine. The protocol treats both identically. That was never a problem when both sides of the conversation were humans who could vouch for themselves in the moment – ask a clarifying question, recognise a colleague’s tone, push back on an unusual request. 

It stops being adequate the moment one side is an autonomous system making decisions on behalf of the business. The channel has no mechanism to surface that distinction. The person receiving the message has no way to verify it. And yet the commercial and regulatory consequences of that exchange are identical to a conversation between two humans – sometimes greater, given the speed and volume at which an agent can operate. 

IAM thinking answers the wrong question 

Most enterprises are reaching for identity and access management (IAM) frameworks to address this gap. Permissions, roles, admin consoles – the standard toolkit for controlling what a system is allowed to do inside the organisation’s own infrastructure. 

That solves one problem. It does not solve the one that matters most. 

IAM tells you whether an agent is authorised to act. It says nothing about whether the person receiving that action can verify what just happened, in the moment it happened. A customer on WhatsApp cannot see your admin console. A counterparty’s AI agent on Teams cannot query your permissions database. The backend validation that satisfies internal governance is invisible to everyone outside it. 

Enterprises are answering the first question – is this agent allowed to act? – and assuming it covers the second: can the other party prove what just acted on them? These are different problems. Treating them as one creates a gap that widens with every agent deployed. 

The precedent is already expensive 

This is not a theoretical risk. Regulated firms have already paid heavily for failing to retain and supervise human conversations on exactly these channels. 

Since 2021, the US Securities and Exchange Commission (SEC) has levied more than $2 billion in fines against over 100 firms for off-channel communications violations – employees conducting business on WhatsApp, Signal and personal text messages outside of the firm’s recordkeeping infrastructure. The Financial Conduct Authority (FCA) reviewed 11 wholesale banks in August 2025 and found 178 breaches of messaging policies in a single 12-month period, with 41 per cent involving directors or senior staff. 

The regulatory premise is straightforward: if a conversation carries business commitments, it must be captured, retained and available for supervision. The channel it travels through does not change that obligation. 

Now consider what happens when the actor on those channels is not a human who might send 50 messages a day, but an AI agent capable of handling thousands of interactions simultaneously. The same ungoverned infrastructure. A faster, more autonomous participant. The compliance exposure does not stay constant. It compounds. 

Trust at the point of conversation, not six months later in an audit 

If an AI agent negotiates a delivery date, approves a claim or commits the business to a price, the identity question needs an answer while the conversation is happening. Not when an auditor reconstructs it months later. Not when a dispute forces both parties to produce records that may or may not exist. 

The gap is structural. Consumer messaging channels were designed for informal, peer-to-peer communication. They carry no native mechanism for establishing the identity of an autonomous system, disclosing its authority, or creating a verifiable record that both parties can access. Bolting IAM controls onto the backend does not change what the person on the other end of the conversation can see – which is nothing beyond the message itself. 

Enterprise adoption of AI agents will not slow down to wait for this problem to be solved. Gartner projects that by 2028, 33 per cent of enterprise software applications will include agentic AI, up from less than one per cent in 2024. The agents are arriving. The question is whether the infrastructure they operate on can make their identity provable to the people they interact with. 

The infrastructure question enterprises are not asking 

The conversation around AI governance has focused heavily on model behaviour – bias, hallucination, safety guardrails. These are legitimate concerns. But they address what an AI agent says and does. They do not address the more fundamental question of whether the other party in the conversation can verify who or what they are interacting with.  

This is an infrastructure problem, not a model problem. The messaging channels that carry an increasing share of business communication were not designed for this. The IAM frameworks being applied to AI agents were built for a different purpose. And the regulatory obligations that already apply to human conversations on these channels do not become optional when the participant becomes a machine. 

Enterprises deploying AI agents into client-facing conversations have a question to answer before the regulator asks it: when your agent commits the business to something on a messaging channel, can the person on the other end prove what just happened?