AI Agents Do Not Need Your Whole Password Manager

Proton Pass may have just solved one of the least glamorous problems in AI agents.

Access.

That sounds boring. It is not. It is probably one of the places where AI automation either becomes genuinely useful or quietly turns into a security incident with better branding.

The more useful agents become, the more they need to touch real accounts. Calendars. CRMs. Email. Dashboards. Password protected admin panels. The awkward truth is that most of the interesting work lives behind a login.

And that is where the magic assistant fantasy gets very uncomfortable.

The password manager problem

You do not want to hand an AI agent your entire password manager.

Not because the agent is evil. Usually the problem is much more boring than that. It is context. Scope. Accidents. Logs. A task that starts as “check this one thing” and somehow ends up wandering through the wrong system because the boundaries were vague.

A normal human can be trusted with broad access because they understand social context. They know when something feels off. They know that “log into this client account” does not mean “start browsing every other client account because the credential is nearby.”

Agents need that boundary made explicit.

Why narrow access matters

Proton’s AI access tokens are interesting because they move the conversation away from “should agents have credentials?” and toward “what exactly should this agent be allowed to use, for how long, and under what conditions?”

That is the right question.

• Put agent credentials in dedicated vaults
• Share only what a specific task needs
• Set expiry windows
• Revoke access cleanly
• Log usage with enough context to audit it later

That is not flashy. There is no demo video of a robot booking a holiday while ordering a pizza and refactoring your backend at the same time. Thank God.

It is infrastructure. The dull stuff that makes the impressive stuff survivable.

Better agents need better permissions

Most AI agent conversations still obsess over capability. Which model is smartest? Which benchmark moved? Which tool can click buttons faster?

Capability matters, but in real businesses the limiting factor is rarely “can the agent do the thing?” It is “can I safely let the agent near the thing?”

That is a very different product problem.

If agents are going to become part of daily business workflows, security and control cannot sit outside the system as a policy document nobody reads. They need to be part of the workflow itself.

The future of agents is not just what they can do.

It is what they are allowed to access.