Shared PCs for people and AI call for access checks on every request

A single login can no longer establish trust for every request from a laptop shared by a person and AI agents. Access controls need to assess who or what initiated each request and the task it serves.

In its “Defense in Depth, Rebuilt for Machine Speed” report published on November 6, 2026, Andreessen Horowitz said identity, endpoint security and network access should become a single decision. The older model treated the user and the machine as effectively interchangeable, trusting a session after login. AI agents have broken that assumption, the report argued.

A developer’s laptop can now host a person, a coding agent with its own keys and a browser agent with separate sessions, all sending requests from the same machine in the same minute. Andreessen Horowitz said trust must depend on whether a person or software produced each request. That assessment must happen on the device, because the distinction is lost once traffic reaches the network.

The report proposed granting access only when a task requires it, using context to determine permissions and withdrawing them when the task ends. It attributed current friction to standing privileges that require periodic review. Removing those privileges would allow most access decisions to happen in the background.

Under the proposed setup, an agent on the device identifies the process and the human or software principal behind each outbound request, then signs it. A broker issues credentials restricted to one task and one resource, with lifetimes measured in minutes. The network rejects requests that are unsigned or outside their permitted scope.

Actions that move money, delete data or grant access require human approval, the report said. Every action an agent takes is logged against the person who launched it, preserving accountability for automated work.

Andreessen Horowitz identified three measures for buyers assessing these systems: the standing credentials that retain production access, the activity that can be attributed to a human or software principal, and the time needed to revoke a session after it is flagged.