AI agents as employees: joiner, mover, leaver

E3 Magazine published NTT Data's HR model for AI agents on October 19. The argument: manage agents the way you manage people. Write a job description, select the right candidate, onboard, train, set a career path, and let go of the ones that underperform. The Chief AI Officer becomes the HR manager for a digital workforce. Oliver Köth, who leads technology and innovation for NTT Data in the DACH region, frames agent deployment as a leadership task for the whole organization.

The model is useful because every HR event it names already has a twin in a well-run enterprise. When a person joins, moves or leaves, identity teams provision, adjust or revoke access. They call it joiner, mover, leaver. HR owns the person. Identity and finance own what the person may touch and what the person may approve. The HR model for agents describes the first lifecycle. The second one decides whether an agent can be trusted with a payments API.

The two lifecycles, side by side

Joiner: a job description and somebody else's credentials

A US employer has three business days from a new hire's first day of work for pay to verify identity and work authorization on Form I-9 (USCIS, verified as of October 20, 2026). A badge, a set of entitlements and, for some roles, a signing limit follow. By the end of week one the company knows who the person is, what they can open and what they can approve.

An agent arrives with a job description and no identity of its own in that sense. It runs on a service account, an API key, or a token a person delegated to it. Each answers a narrower question than HR answers for a person. A service account says which system is calling. A delegated token says whose access is in use. Neither says which task the agent is on, how far the delegation goes, or who answers for the result.

The NTT Data piece asks the right onboarding questions: what the agent does, which systems it may use, when it decides alone, when a human comes in. Those answers are the agent's entitlements and its signing limit. Written into a job description, they are intent. They become controls when something checks them at the moment the agent acts.

Signing authority: the job description is a document

A new hire in accounts payable cannot release a wire above their limit. The limit is in their job description, and the payment system enforces it with a second approver. A person who tries to exceed it gets stopped by the system, whatever they believe their job allows.

An agent with the payments API on its allowlist passes every access check the API runs. The API checks the credential. It never reads the job description. Delegation of authority for agents has to be enforced in the path between the agent and the tool, per action, at the speed the agent calls.

Continuing education: a rule the agent learned is a suggestion

The piece describes two kinds of agent learning. Agents refine their approach from past tasks, and the company feeds them new rules when a regulation changes or a compliance requirement moves. Its example is a product engineering agent that has to learn a material is no longer permitted.

For people, a policy change arrives twice: once in training and once in the systems that enforce it. An expense policy sits in the handbook and in the expense tool, which rejects the receipt. An agent taught a new rule through its instructions or its knowledge base has absorbed it the way a person absorbs a handbook. Whether it follows the rule on the next call is a matter of probability. The rule becomes a control when the call that would break it is checked against policy before it goes out.

Mover: the promotion happens in a prompt

The piece's career path takes an agent from responding to commands to pursuing goals. Instead of processing a specific form, the agent is told to cut checkout time or improve inventory availability, and it works out the steps.

In identity governance, the mover is where privilege creep starts. A person changes roles and keeps the old access, which is why a promotion or a transfer triggers an access review. An agent's promotion is a change of instruction. Given a goal instead of a task, it chooses its own tools, and the set of systems it touches widens with the goal. No ticket is opened. No reviewer signs. The access granted to the agent may not change at all. The access it exercises changes completely.

That gap is why per-role permissions stop being enough. A goal-seeking agent's actions cannot be listed in advance. Each one has to be checked against the authority behind it when it happens.

Leaver: shutting down the agent leaves its access behind

The piece counts speed as an advantage: digital workforces scale up or shut down within minutes.

Shutting down an agent stops a process. The OAuth grant a person gave it, the API key in the vault and the service account it ran under persist unless someone revokes them. For people, access that outlives employment is a standard test in an IT general controls audit, and offboarding checklists exist because revocation does not happen by itself. An agent workforce that scales in minutes needs revocation that runs at the same speed and reaches every credential the agent was issued or handed.

The manager of record

The piece keeps people on the hard decisions. In its supplier example, an agent analyzes past procurement cases, scores supply-chain risk and ranks alternatives, and a person negotiates and makes the final call. That division of labor depends on one thing HR settles for every employee: a named manager who answers for the work.

The CAIO can own the program. The CAIO cannot be the manager of record for every agent in the company. For each action an agent takes, the accountable party is the person whose authority the agent is using. That person has to be identifiable at the moment of the call, the action has to stay inside what they delegated, and anything outside it goes back to them to decide.

Where APERION sits

APERION builds Smartflow for that path. It sits between agents and every model and tool they call, rented or owned, inside the enterprise's own walls, and checks each action against the authority a person delegated. An action beyond that authority goes back to the person, who decides with proof they were there, and the record is bound to the human who owns it.

Craig Alberino is co-founder and CEO of APERION. Owned intelligence, governed from the first call: APERION governs every agent and every model an enterprise rents or owns from one control point inside its own walls. Related: the enterprise AI gateway guide.