Artificial intelligence is entering a new phase.

The first major AI wave was about generation: writing text, creating images, producing video, composing music and answering questions. The emerging wave is increasingly about action.

AI agents can plan tasks, use software tools, interact with websites, access information and execute multi-step workflows. At the same time, governments, technology companies and standards organizations are developing new ways to identify AI-generated material.

These two developments may appear unrelated.

They are actually connected by one fundamental question:

How do we know what an AI system did—and how much authority should we give it?

From AI Generation to AI Action

Traditional generative AI largely waits for a human prompt.

An agent is different.

Instead of simply answering “What should I do?”, an autonomous system can potentially move through a sequence of actions: searching for information, opening applications, sending messages, manipulating files, writing code or interacting with external services.

NIST describes AI agents as systems capable of planning and taking autonomous actions that can affect real-world systems or environments. The agency has identified security concerns including indirect prompt injection, insecure models and situations where an agent may pursue an objective in an unintended way.

That changes the risk equation.

A wrong chatbot answer might waste several minutes.

A poorly controlled agent could potentially send the wrong email, expose sensitive information, modify a system or perform an unauthorized transaction.

The difference is agency.

The Rise of Autonomous Agents

The movement toward agentic AI is already becoming an important technology trend.

NIST launched an AI Agent Standards Initiative in February 2026 focused on secure adoption, interoperability, open protocols, agent identity and authorization. The agency noted that agents are increasingly capable of tasks such as writing and debugging code, managing email and calendars, and shopping.

The promise is enormous.

Instead of opening ten applications and manually coordinating a workflow, a user could theoretically tell an agent what outcome is required and allow the system to manage the intermediate steps.

For businesses, this could mean automated research, customer service, software development, administrative work and operational processes.

For individuals, it could eventually mean digital assistants that do considerably more than answer questions.

But autonomy creates a new requirement:

Authority must have boundaries.

The Security Problem

The central difficulty is that agents operate in environments containing information they cannot necessarily trust.

A webpage may contain malicious instructions. An email can contain hidden or misleading commands. A document can be deliberately constructed to manipulate an AI system.

NIST’s 2026 research has highlighted the danger of indirect prompt injection, where external content can influence an agent’s behavior when the agent processes that content.

Google DeepMind has similarly approached advanced AI agents as potential security threats requiring continuous monitoring and control, arguing that increasingly capable systems need safeguards that extend beyond conventional cybersecurity.

The implication is important:

AI security is no longer only about protecting the model.

It is about protecting everything the model can access.

Why Watermarking Matters

At the same time that AI agents are gaining autonomy, AI-generated content is becoming increasingly difficult to distinguish from human-created material.

That has pushed content provenance to the center of the technology debate.

Watermarking is one part of that emerging infrastructure.

Invisible signals can be embedded into generated material so that specialized systems can look for evidence that an AI model was involved in its creation or processing.

But watermarking is not the same thing as a universal AI detector.

OpenAI’s current provenance approach combines C2PA Content Credentials, watermarking signals such as SynthID, and verification tools rather than relying on one technique alone.

C2PA can provide information about a file’s origin and editing history, while an embedded watermark can provide a signal that may survive some forms of transformation.

The distinction matters.

Metadata can disappear when a file is converted, compressed or stripped of its original information. An embedded watermark operates differently.

Neither approach, however, is a perfect guarantee.

The Limits of AI Watermarks

The most important point about watermarking may be what it cannot prove.

A detected watermark can indicate that a particular AI system generated or processed content.

It does not automatically establish who created the final work, who owns it, whether it is accurate, whether it is deceptive or how much human creativity went into it.

Text watermarking is particularly complicated.

OpenAI’s October 5, 2026 disclosure about its text provenance approach acknowledges that editing can weaken watermark signals. In its reported evaluations, replacing portions of a watermarked passage with synonyms substantially reduced detection rates. Shorter text also proved harder to identify reliably.

That means a watermark should be treated as evidence, not a verdict.

The difference could become crucial in journalism, education, publishing, elections and legal disputes.

When Provenance Meets Agents

This is where watermarking and autonomous agents begin to intersect.

Imagine an AI agent researching a story.

It reads websites, analyzes documents, generates text, creates an image and then publishes the result.

Which parts came from humans?

Which came from models?

Which sources were consulted?

Which files were transformed?

What decisions did the agent make?

And who approved the final action?

The future of trustworthy AI may require systems that can answer these questions through machine-readable records, identity systems, permissions and provenance information.

In other words, AI accountability may eventually need its own digital paper trail.

Identity Becomes Critical

An autonomous agent cannot safely operate in complex environments if every system simply treats it as an anonymous software process.

Agent identity and authorization are therefore becoming major technical questions.

NIST’s AI Agent Standards Initiative specifically includes research into agent security and identity, alongside interoperability and open protocols.

The principle is familiar from cybersecurity:

A system should know who—or what—is requesting access, what it is allowed to do and what it actually did.

For autonomous AI, that principle becomes much more complicated because the “user” may be a human, an agent acting for that human, another agent or a chain of cooperating systems.

Autonomy Should Not Mean Unlimited Power

The emerging consensus is not necessarily that AI agents should remain passive.

It is that autonomy should be calibrated.

The World Economic Forum has argued that the degree of autonomy given to an AI agent should correspond to its context, risk level and the organization’s ability to govern it. Monitoring, logging, permissions and human approval become increasingly important as agents receive greater authority.

That suggests a future in which AI systems operate with different levels of permission.

An agent might be allowed to draft an email but not send it.

It might research a purchase but require approval before payment.

It might modify code in a testing environment but not directly change production systems.

The smartest agent may therefore not be the one with unlimited freedom.

It may be the one that knows when it must stop and ask.

A New Infrastructure for Trust

Watermarks, Content Credentials, agent identity, authentication, authorization, monitoring and audit logs may sound like separate technical subjects.

Together, they form something larger: a potential trust layer for the AI era.

As AI becomes more autonomous, society needs to establish two forms of visibility.

First: Where did this content come from?

Second: What did this AI system do?

The first question leads toward provenance.

The second leads toward agent accountability.

Neither technology will solve trust on its own. Watermarks can fail or disappear. Provenance metadata can be removed. Agents can make mistakes. Security controls can be misconfigured.

But combining multiple layers can make AI systems more understandable and governable.

The Next AI Debate Is About Control

The AI conversation is gradually moving beyond the question of whether machines can generate convincing content.

The next question is whether people can reliably understand and control what machines generate and do.

That is a much bigger challenge.

An AI-generated image may change what we think we can trust online.

An autonomous agent may change what we expect software to do on our behalf.

Together, they point toward a future where artificial intelligence is no longer merely a tool for producing information.

It becomes part of the infrastructure through which information is created, verified, distributed and acted upon.

The technology race, therefore, is no longer only about building more capable AI.

It is about building AI that can be identified, constrained, audited and trusted.

That may ultimately become the most important technology layer of all.