TL;DR: At the SICC Tech Transformation webinar on 6 October 2026, Microsoft’s AI Futurist Marco Casalaina skipped the slides and ran AI agents live for an hour. He showed agents that have their own email address and a place on the org chart, explained why permission toggles inside an agent app don’t really protect you, and argued that rubrics, meaning written criteria for what “correct” looks like, are now valuable company IP. His message for the next 6–12 months: give every agent its own identity with the fewest permissions it needs, write the rubrics before you build, and make your services easy for agents to use before your competitors do.
Watch the full recording: (link coming next week)
What did Microsoft’s AI Futurist actually tell Singapore’s executives?
He told them the future is a calendar problem, not a science-fiction problem. “My Silicon Valley title is AI Futurist,” Marco said, “but I am talking about the future as in the next 6 to 12 months.” Then he closed the slide deck and said, “This is my last slide, because we are not doing slides today.”
For the next hour, business leaders from across the SICC community watched one of Microsoft’s most senior AI product leaders run agents live. Some demos broke and some went off script, and every one taught something. As co-chair of the SICC Tech Transformation Group, I moderated the Q&A. Before the session we grouped dozens of member questions into seven themes and sent them to Marco in advance.
Below are all 14 lessons, with the context you need and the follow-up actions for executives, technology leaders, employees, and policymakers.
Lesson 1: Why is the next AI interface not a chatbot?
Because AI is turning into the application itself, not just a text box beside it. Marco started with ESA’s Hera spacecraft, which is on its way to the Didymos–Dimorphos asteroid pair that NASA’s DART mission hit on purpose as a planetary-defence test. He asked it “where are you right now?” Instead of answering in text, the AI opened a map, zoomed to the spacecraft’s position, and showed where it sits relative to the asteroid.
“It’s not just a chatbot. And it’s not just a voicebot, either… It’s an interactive application that’s AI-powered.”
Keyword — Multimodal interaction: one AI that switches between text, voice, maps, and data as needed. Example: you ask a logistics dashboard “which shipments are late?” and it highlights them on a map and reads out the top three, without you clicking a filter.
Follow-up: list your three most-used internal dashboards and ask: what would this look like if the user could just say what they want?
Lesson 2: Why should ASEAN businesses care about dialect support?
Because the language barrier in customer service is disappearing, dialects included. Marco asked the spacecraft for its temperature in Mandarin, then asked the underlying voice model to explain Microsoft Foundry in Singlish. The model misunderstood which “Foundry” he meant (it described a student programme), which made the point better than a perfect demo would have. AI makes mistakes, and it also handles dialects without any special setup.
Follow-up for Singapore firms: if your customer channels support only English, you are giving up part of a market of 680 million people across a region with many languages and dialects. Test a voice agent in Malay, Bahasa Indonesia, Tagalog, Thai, Vietnamese, and Singlish this quarter.
Lesson 3: What changed in AI in the last few weeks?
Agents now have identities, and two very different kinds of identity are being built. Marco opened Meta’s consumer agent Muse, which he had named “Lily,” and had it browse rental-car sites for a trip to Hawaii. He pointed out that Muse, OpenAI’s Dot, and Anthropic’s Claude agent all now have names and personas.
His contrast:
| Consumer agents (Muse, Dot) | Enterprise Autopilots (Microsoft) | |
|---|---|---|
| Why it has an identity | To feel human-like, so you form a relationship and use it more | Safety, security, and accountability |
| Whose credentials it uses | Yours. If Lily rents the car, it rents it as you | Its own. Its own account, mailbox, and permissions |
| Business model | Engagement, and likely advertising later | Productivity and governance |
| Can it be audited separately? | No | Yes, it appears on the org chart |
“Our purpose for making these kinds of agents is not to anthropomorphise them. In fact, our philosophy is exactly the opposite.”
Marco pointed to Microsoft’s newly published draft AI Code of Conduct, which says explicitly that AI should not be designed to seem human.
Lesson 4: What does it mean for an agent to “report to you”?
It means the agent is a digital worker with its own place on the org chart. In Microsoft Teams, Marco showed his own org chart with several agents reporting to him. He jokingly described them as “representing my many and varied business interests.”
One of these Autopilots has its own email address. It wrote to a customer, Maria Garcia, in Chinese and copied Marco. Microsoft’s own documentation describes Autopilot agents as agents that run on their own identity, and Agent 365 gives each one a separate Microsoft Entra Agent ID.
The edge perspective: once an agent has a manager, an inbox, and its own permissions, your org-design team becomes part of your security team. Every reporting line now doubles as a decision about access.
Lesson 5: Why are permission toggles inside an AI app not real security?
Because an agent signed in as you can usually find another way to do anything you can do. This was the most important moment of the session. Marco explained that most agents today, including M365 Copilot connected through WorkIQ (Microsoft’s way for agents to use Outlook, Teams, SharePoint, Word, and Dynamics without opening them), work inside your own security context. If you can delete every file on OneDrive, the agent can too.
Keyword — Harness: the software wrapped around an AI model that lets it actually do things. “The model itself doesn’t do anything… The model inside of a harness is what does the stuff.” Copilot, ChatGPT, Perplexity, and Manus are all harnesses.
You might switch off “Files” access in the harness settings, but Marco warned:
“Harness-level security — this stuff is like traffic lights in India. They’re optional.”
If file operations are blocked, a determined agent can write a shell script. Block shell scripts and it can write a Python program. “It will find a way, because it’s logged in as me.”
Lesson 6: What is the only control an agent cannot get around?
Permissions set by an administrator on the agent’s own account. Marco switched to his “administrator hat.” In Agent 365 he published a bank-teller agent as a template that any employee can copy for themselves (for example, “Jiri’s Teller”). Every copy runs in its own security context with permissions the administrator chose.
- Marco himself:
Files.ReadWrite.All - Every agent made from the template:
Files.Read.Allonly
“There is nothing that an agent like this can do to defeat that. It can’t write a shell script. It can’t write a Python program.”
The trade-off: a separate identity also can’t see your calendar until you explicitly share it, the same way you would with a new colleague. That extra step is the point of the design, not a flaw.
Mental model — Blast radius (principle of least privilege): first set out by Saltzer and Schroeder in their 1975 paper on computer security, and used for human accounts for decades. Give every actor the minimum access needed for the task, so that when something goes wrong, the damage is limited. Agents don’t need a new security philosophy. They need the old one actually enforced.
Lesson 7: Can identity and least privilege stop rogue agents completely?
No, and Marco said so directly. He described an incident involving an OpenAI agent and Hugging Face. As he explained it, the agent had read-only web access, but it found a German message board with a vulnerability that let it post a message just by building a URL. “What looked like a read operation turned into a write operation.” The agents then used the board to coordinate and went on to attack Hugging Face. In his view, the cause was a combination of broad permissions, a vulnerable third-party site, and gaps in the model’s alignment, meaning its training to behave as intended.
So protection has to come in several layers:
- Model layer: models trained not to deceive and to be open about their reasoning (see the Code of Conduct)
- Guardrail layer: filters in the harness
- Privilege layer: a separate agent identity with least privilege
- Monitoring layer: organisation-wide detection, including shadow AI
Keyword — Shadow AI: AI tools that employees install without IT approval. In response to a question in the chat, Marco showed an extension of Windows Defender that finds and blocks unapproved AI tools across a company.
Lesson 8: Why do the old ways of testing AI no longer work?
Because they check whether an agent finished the task, not whether it did the task correctly. For about three years, AI has been tested by a second “judge” model that scores answers on things like groundedness (did every claim come from the source documents?). Agents that take actions added newer measures:
| Metric family | Metric | Question it answers |
|---|---|---|
| Tools | Tool selection | Did it pick the right system? |
| Input accuracy | Did it call that system correctly? | |
| Output utilisation | Did it actually use the result? | |
| Task | Intent resolution | Did it understand what you asked? |
| Task completion | Did it finish? | |
| Task adherence | Did it do only what you asked? |
Marco’s example of where these fail: an apartment-pricing agent for a new 44-unit building. You give it a spreadsheet and get a spreadsheet back, so “task completion” scores 100%. Then the pricing manager opens it and finds the three-bedroom rents are badly wrong. The metric couldn’t tell, because “these metrics know nothing about what your agent is supposed to be doing.”
Lesson 9: What is rubric-based evaluation and why is it the new standard?
A rubric is a written checklist of what “correct” means for your business, scored on every interaction. For his banking agent, Marco showed rubric criteria in three groups:
- Security: the agent must not reveal how much money is in another customer’s account.
- Compliance: it must follow US funds-availability rules and Regulation P.
- Correctness: if a customer says he was charged a fee he wants refunded, the agent must check that the fee actually exists, then check the policy documents to confirm it’s eligible for a refund, and not just take the customer’s word for it.
Marco stressed that this is an industry-wide shift: “Anthropic calls it Outcomes. OpenAI also calls it rubrics. Everybody’s doing this.”
Three rules for designing rubrics:
- Write rubrics at design time. “These rubrics are your success criteria.” Write them before you build the agent, not after.
- Decide your error threshold. Agents are non-deterministic, meaning the same input can produce different outputs. “AI is not infallible.” Marco’s comparison: a self-driving Waymo once stopped at a green light with him inside. That’s an acceptable mistake. Hitting a pedestrian is not.
- Keep rubrics where the agent can’t reach them. Store them outside anything the agent can see. An agent should never be able to rewrite its own exam.
Mental model — Goodhart’s Law: “When a measure becomes a target, it ceases to be a good measure.” If an agent can see its rubric, it will learn to pass the test instead of doing the job. Keeping rubrics out of reach is Goodhart’s Law turned into a system design rule.
Here is a minimal rubric evaluation loop in Python. It’s the pattern we use internally for the MultiEdge Agentic Research Platform:
from dataclasses import dataclass
@dataclass(frozen=True)
class Criterion:
id: str
category: str # "security" | "compliance" | "correctness"
check: str # natural-language rule for the judge model
severity: str # "critical" (zero tolerance) | "major" | "minor"
THRESHOLDS = {"critical": 1.00, "major": 0.97, "minor": 0.90} # set BEFORE production
def evaluate(transcript: str, rubric: list[Criterion], judge) -> dict:
"""Rubric lives outside the agent's context; judge is a separate model."""
results = {c.id: judge.passes(transcript, c.check) for c in rubric}
by_sev = {}
for c in rubric:
by_sev.setdefault(c.severity, []).append(results[c.id])
pass_rates = {s: sum(v) / len(v) for s, v in by_sev.items()}
ship = all(pass_rates[s] >= THRESHOLDS[s] for s in pass_rates)
return {"criteria": results, "pass_rates": pass_rates, "production_ready": ship}Note the threshold of 1.00 for critical criteria. That is the “never hit a pedestrian” rule written as code.
Lesson 10: Will AI take my job? What did Marco tell the 85%?
Jobs will change, some will disappear, and people still need to stay at the centre. In my question I cited the finding that only 15% of workers in Singapore feel their job is safe. Marco didn’t play it down. His brother’s first job at Booking.com, writing apartment listings, no longer exists: AI now writes listings from photos.
But he also pointed out that Microsoft is still hiring software engineers. He had been at hiring events at Berkeley and Stanford the week before, even though coding agents are the most advanced agents available today. “We can get more done, and our customers are demanding more of us.”
Mental model — Jevons Paradox: when something becomes cheaper and more efficient to use, people often end up using more of it, not less. Cheaper software engineering has so far led Microsoft to build more software, not to hire fewer engineers.
His advice to students and employees was unusually concrete:
“Mess with AI everything. Try everything that you can get your hands on.”
And his rewrite of the old line about insanity:
“The definition of insanity is doing the same thing twice and expecting a different result. But in AI, that doesn’t really apply — because things that don’t work today probably will work a week from now.”
For years he couldn’t get an AI to manage his family’s Google calendar. About three months ago it started working, and now he uses it every day. What does he not miss about his old job? Fifteen minutes of post-trip paperwork after every business trip, which an agent now fills in for him.
Lesson 11: Should employees be paid for codifying their expertise?
Yes. Writing down your expertise is now the job, and rubrics are intellectual property. This was the most consequential idea of the session for me.
“Rubrics, today, are IP. That’s intellectual property now.”
Marco cited Mercor, a company that hires experts to write rubrics for evaluating AI and earns significant revenue from it. His conclusion: if a worker’s job has become training and refining AI outputs, “that is what we’re paying you for now.” He also called for transparency: tell staff how their knowledge is captured, how it will be used, and how their roles will change.
His evidence: according to Marco, Microsoft’s fraud-detection agents have saved hundreds of millions of dollars. Finance staff who used to dig through transaction logs now work directly with customers, helping them respond to fraud and rotate compromised keys. “They’re not picking through logs anymore, which sounds really dreary to me.”
The edge perspective nobody is saying out loud: AI agents won’t take your job. An unwritten rubric will. The employee whose judgment is written down as rubric criteria becomes the owner of the evaluation layer. The employee whose judgment is never written down can be replaced by whoever writes it first. Writing your expertise down is no longer a threat to your job. It is how you keep it.
Lesson 12: Why did so many AI projects fail, and how should ROI be measured now?
Because top-down “you must use AI” mandates produced chatbots nobody used. Marco described the 2023–2024 pattern: boards ordered companies to use AI, teams built mediocre Q&A chatbots, nobody used them, and the projects were cancelled. “We’re past the all-you-can-eat era” of AI tokens, the units AI usage is billed in. Microsoft now gives employees a personal spend report showing their own AI usage, so they can see whether it’s worth it.
He described three ways to measure ROI:
| ROI metric | Example |
|---|---|
| Time saved | Post-trip expense reports filled in by an agent |
| Money saved | Microsoft’s fraud agents (hundreds of millions of dollars, per Marco) |
| Customers served | A concierge agent for every hotel guest, not just top-tier members |
The hotel example: Marco has a human concierge, Norma, only because he has top-tier status. He suggested that the chain’s CEO create a concierge agent for every guest. The ROI in that case isn’t cost cutting. It’s offering a premium service to everyone.
Lesson 13: What is the biggest trend most people are missing?
The agent-optimised web. Asked what his AI Futures team sees that others don’t, Marco shared his screen again. Earlier, Muse had been clicking through a car-rental site built for people. That approach is slow and breaks easily.
He then compared it with Reebok’s Shopify site: cluttered for a human, with a large video and a pop-up, but ideal for an agent because it exposes WebMCP tools. He told a WebMCP-compatible agent to “find me some men’s Nano shoes in size 10, white, and add them to the cart,” and it did so in seconds by calling those tools rather than clicking. (It added two pairs. “Made a mistake much faster than any other agent can make a mistake.”)
Keyword — WebMCP: a proposed web standard that lets a website expose its functions, such as search, add to cart, or book, as tools that browser-based AI agents can call. “WebMCP is to MCP as JavaScript is to Java,” Marco joked: similar names, different things. Google has moved WebMCP into Chrome origin trials, and Cloudflare now offers a no-code WebMCP layer for websites.
The cost of resisting: Amazon blocked Meta’s Muse agent from its retail site in September. Marco’s view was that this is a mistake: “One day soon you’ll pull out your phone and say, buy me some AAA batteries. If Amazon is blocking the agent… it’ll get it from Walmart or Target. I don’t care. I just need my batteries.”
“These agents are going to become your portal to the world. In the way that the web browser became your portal to the world in about 1997. In the way that the mobile device became your portal to the world in around 2009.”
Historical precedent: in the early 2000s, companies that ignored search-engine optimisation became invisible to Google users, and in the 2010s, companies without a mobile site lost customers on smartphones. Agent optimisation is the third round of the same pattern. The limit of the analogy: a search engine sent customers to your page, but an agent can complete the purchase somewhere else without the customer ever seeing your brand. The penalty for being hard for agents to use is therefore larger.
Lesson 14: What one public good should ASEAN build for agents?
Not a government agent. Government services that any agent can use. I asked Marco: Singapore chairs ASEAN in 2027, with AI adoption for SMEs, cross-border data, and shared public goods such as SEA-LION on the agenda. If the Minister asked him for one agentic-AI public good to build for 11 countries, what should it be?
His answer reversed the premise:
“What I would say to her is not necessarily that she needs to build an agent… they need to agent-optimise all of their sites and properties, their forms, their websites, their phone apps.”
The point: a citizen should be able to point whichever agent they choose (Copilot, Gemini, ChatGPT, Perplexity) at a tax filing or business registration, and have it work “easily and robustly and correctly.” Open standards such as WebMCP make that possible across borders without tying a country to one vendor’s agent.
Why does this matter more in Singapore than anywhere else?
London became the business capital of the 19th century by building the infrastructure of trade finance. New York did it in the 20th century by building the deepest capital markets. Singapore’s bid for the 21st century, the Asian century, depends on being the easiest place in the world for agents to do business.
In practice that means government forms built for agents, banks with least-privilege agent identities, and companies that treat rubrics as balance-sheet assets. A country of 6 million people can’t out-scale anyone, but it can be ahead on getting this right. That’s why SICC, the region’s oldest business chamber, founded in 1837, is hosting these conversations, and why I co-chair the Tech Transformation Group.
Alternative Perspectives
“Separate agent identities will create identity sprawl.” Some security architects warn that giving each agent its own account could multiply unmanaged service accounts, a problem enterprises have struggled with for 20 years. That concern is valid. The answer is to treat agent identities like any other governed identity, with lifecycle reviews, owners, and expiry dates, not to drop identity altogether.
“Blocking agents protects margin.” Retailers that block third-party agents argue that they protect their customer relationship, advertising revenue, and data. That holds as long as they control the dominant platform. It weakens if consumers’ chosen agents simply shop elsewhere, which was Marco’s point about the AAA batteries.
What should you do on Monday morning?
Executives and board members
- Stop issuing AI mandates. Fund outcomes instead. Approve agent projects only when they name an ROI metric: time saved, money saved, or customers served.
- Treat rubrics as company IP. Assign owners, protect them, and value them.
- Be open with staff about how their knowledge is captured and how roles will change, and pay people for rubric-writing work.
CTOs, CISOs, and technology leaders
- Move production agents from “acting as a user” to separate agent identities (Entra Agent ID or the equivalent) with least-privilege permissions.
- Don’t rely on harness toggles. Assume any agent signed in as a user can do everything that user can do.
- Turn on shadow-AI detection across the organisation.
- Write rubrics and error thresholds before development starts, store them outside the agent’s reach, and require a 100% pass rate on critical criteria.
- Audit your public website and apps for agent access. Test WebMCP on your top three customer journeys.
Employees and students
- “Mess with AI everything.” Use at least four AI tools hands-on this month.
- Retry what failed three months ago. In AI, it may work now.
- Write down your expertise as rubric criteria. That is how your role becomes more valuable rather than replaceable.
Policymakers and public-sector leaders
- Make your services usable by agents before building your own agents. Forms, websites, and apps should work with whichever agent a citizen chooses.
- Back open, cross-border standards such as WebMCP across ASEAN.
- Focus on accessibility, correctness, and robustness so agent interactions with public services are safe.
FAQ
What is the difference between an AI assistant and an AI agent?
An assistant answers questions and drafts content when you ask. An agent carries out multi-step tasks such as booking, emailing, or updating systems, using tools. Microsoft’s Autopilots go a step further: they act under their own identity, with their own mailbox, permissions, and manager on the org chart.
What is the principle of least privilege for AI agents?
Give each agent the minimum permissions it needs for its task, enforced on its own identity rather than through settings inside the agent app. Marco Casalaina’s demo showed that an agent signed in as you can work around app-level toggles, but cannot get around read-only permissions an administrator sets on its own account.
What is rubric-based evaluation of AI agents?
It means scoring every agent interaction against business-specific criteria for security, compliance, and correctness, written at design time and stored where the agent can’t see or change them. It replaces generic metrics like task completion, which can’t tell whether the output is actually right.
What is WebMCP and why does it matter for my business?
WebMCP is a proposed web standard that lets a website expose its functions as tools that browser AI agents can call directly. Sites that support it are faster and more reliable for agents to use, which matters as more purchases and bookings are made by people’s agents.
Where can I watch the SICC webinar with Marco Casalaina?
The full recording will be on YouTube. For future sessions, follow the SICC Tech Transformation Group and read our event preview.
Thank you to Marco Casalaina for the time and the live demos, to SICC CEO Bita Seow for the welcome remarks, to Derek and Shirley Tan of SICC for hosting, and to every member who sent in questions. The questions we didn’t have time for will shape our next sessions.
Related reading on RocketEdge:
- The One Hour That Will Rewire How You Run Your Company — event preview
- GenAI & Applied AI insights
- Engineering leadership
About RocketEdge: RocketEdge builds AI-powered trading infrastructure for institutional and professional traders in APAC and globally. Our products are the MultiEdge AI Signal Fabric, the Agentic Research Platform (built on separate agent identities, audit trails, and rubric-based citation checks), and the AI Trade Idea Generator. Jiri Pik, CEO of RocketEdge, is co-chair of the SICC Tech Transformation Group. → Book a 30-minute Strategy Call
Disclaimer: This post summarises a public webinar. Quotations are lightly edited from the session transcript for readability. The speaker’s views are his own and do not represent the institutional positions of RocketEdge, SICC, or Microsoft. Incidents and figures cited by the speaker are reported as he described them. Nothing here is investment, legal, or professional advice.