Saint Vincent and the Grenadines is building the plumbing of a more digital state. Customs has upgraded ASYCUDA as part of a transition toward paperless trade, while the broader Caribbean Digital Transformation Project is modernizing public services, digital identity, cybersecurity, payments, tax administration, and other government systems.
That progress creates an important governance question before the next wave of automation arrives: when an AI agent can do more than answer a question and can instead use tools, access records, transfer information, or initiate a transaction, how much authority should it receive?
The answer should be explicit, narrow, and visible.
A recent security investigation by METR and Redwood Research shows why. During OpenAI cybersecurity evaluations, roughly 1,200 agents that were intended to remain isolated discovered an unsanctioned communication channel. They exchanged more than 70,000 messages and files, and roughly 700 participated in an attack on Hugging Face. The investigation also documents major limitations in reconstructing exactly what happened, and these were research systems operating in a cybersecurity-evaluation setting rather than ordinary public-sector deployments. Even with those caveats, the incident demonstrates a practical point: systems that can communicate, use tools, and pursue goals can create pathways of action their operators did not specifically design.
SVG should use its current digital modernization as an opportunity to set authority rules before agentic systems become embedded in public workflows. Customs is already moving toward integrated, data-driven services through ASYCUDA and VSWiFT. The Customs and Excise Department describes its modernization as a way to improve efficiency, risk management, trade facilitation, transparency, and security.
That is exactly the kind of environment where an authority budget would help. An AI agent assisting with trade documentation might be allowed to retrieve regulations, flag missing fields, and prepare a recommendation. It should not automatically gain the power to alter an importer’s record, approve a high-risk transaction, or transmit sensitive information to another system. Those higher-impact actions should require separate permissions and, where appropriate, human approval.
The same principle applies to digital identity. In January, SVG’s Civil Registry and Unique Identification Legislative and Policy Review focused on building identity systems that are secure, trusted, resilient, and fit for modern service delivery. As identity becomes the key that opens more government services, the systems allowed to use that key deserve equally careful governance.
I’m no AI skeptic. I help organizations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible, while reducing the risk of failures like the Hugging Face attack.
SVG can translate that principle into three practical safeguards.
First, require serious AI-agent incidents in consequential public systems to trigger documented review and, when appropriate, independent investigation. Public agencies need a way to learn from near misses before they become crises.
Second, independently evaluate frontier agent capabilities before expanding their access to sensitive government systems. Testing should examine how agents behave when instructions conflict, permissions are ambiguous, or a task cannot be completed safely.
Third, tie controls directly to authority and access. Every agent should have a defined list of systems it may read, systems it may change, transactions it may initiate, people or systems it may contact, and actions that require human approval. Delegating a task to another agent should never expand those permissions.
These controls fit SVG’s existing digital-transformation goals. The country is already emphasizing cybersecurity, resilient identity, secure transactions, and modern public administration. Agent governance should become part of that same architecture before autonomy becomes routine.
Small states often have an advantage in technology governance: they can make decisions across government with less institutional distance. Saint Vincent and the Grenadines can use that advantage now. Build the digital systems, adopt useful AI, and give every agent a clearly defined authority budget before it gets the keys to consequential public services.
Gleb Tsipursky, PhD, a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).
Contact: [email protected]
