OpenAI Presence: enterprise agents and the control question

On 22 July 2026 OpenAI introduced Presence — a platform for deploying AI agents in large organisations. It is a step from raw model access toward a managed system: the company describes Presence as a shared foundation for company context, policies, permissions, guardrails, actions and agent evaluations. What is interesting is that security and governance become a product here, not an afterthought — but that does not relieve the customer of responsibility.

What was announced

Presence targets customer support, outbound sales and “high-risk” internal workflows, across voice and chat channels. OpenAI names BBVA, SoftBank and IAG as companies exploring the platform. The product is in limited general availability, with deployments led by OpenAI’s Forward Deployed Engineers and select integrators — no self-service tier.

As evidence of effectiveness, OpenAI says Presence powers its own English-language support line and resolves 75% of issues without a human, and that a Codex-driven improvement process cut human handoffs by 15 percentage points in 10 days. These are the vendor’s numbers — read them as a claim, not an independent audit.

The good news: policies and guardrails by default

From a security standpoint, the direction is right. The key risk with agents is not the quality of reasoning but the right to act: an agent given tools and a long-running goal can, in an ambiguous situation, pick the wrong shortcut. Baking policies, permissions and escalation rules into the platform means those barriers are part of the architecture, not an ad-hoc idea from the deployment team. This aligns with the principles we lay out in AI agents: automation without losing control.

What the platform does not solve for you

A vendor’s guardrails do not know your environment. They do not know that this particular agent can delete a specific project or copy a token into another zone. That context must be enforced on your side. However good the platform, the same principles apply:

• A separate agent identity — not on an admin or employee account, so every action is attributable.
• Read/write separation — irreversible operations (deletion, publishing, secret transfer) behind separate, short-lived authorisation.
• Gates for irreversible effects — confirmation with a preview of the exact operation.
• A minimal environment scope — sandbox, host allowlist, API limits.
• Independent result validation — “done” is not proof.

This is the practical extension of AI and LLM security in business.

A new surface: an agent wired into your systems

By design, Presence connects the agent to internal systems. That means the attack surface now includes not just the model but also the connections, permissions and data the agent can reach. Vectors like prompt injection or tool poisoning gain real consequences when the agent can perform an action, not just answer with text. When deploying such a platform, treat the agent’s identities and permissions like any other privileged access.

The bottom line

Presence shows the market maturing: agent security is moving from an afterthought to part of the offering. That is a good signal. At the same time, no platform will make, on your behalf, the decision about what the agent may do in your environment and how you verify it. If you are planning an agent deployment and want to design its permissions safely, let’s talk.

Sources: OpenAI — Introducing Presence, VentureBeat, Bloomberg Law.