An AI agent compares offers, prepares a purchase order and accesses a company’s procurement system. But does that mean it should also be allowed to order goods worth €80,000 on its own? For Dr. Götz Wehberg, Co-CEO of Gimel Technologies, the answer is clear: technical access is not the same as permission.
“An agent should not be allowed to act simply because it has access to a system, but because its specific action is covered by a valid mandate,” he explains. That is exactly what his startup is working on. Gimel develops digital mandates for AI agents that can be checked technically. They define what an agent may do, on whose behalf, for how long and within which limits.
As AI moves from assistance to execution, knowing an agent’s identity is no longer enough. When agents can place orders, modify data or run programs independently, it is equally important to know which actions they are actually authorized to perform. Ambiguous instructions or manipulated content must not allow an agent to exceed its authority.
Identity is not authorization
The idea behind Gimel emerged from Wehberg’s previous work in innovation at Fresenius. While exploring technology startups, he became interested in digital identity solutions and the challenge of reliably identifying people in an increasingly AI-driven world. Drawing on his experience in healthcare and genetic engineering, he developed the concept for Gimel ID, which aims to create an additional link between a digital identity and a real person using selected genetic characteristics.
DNA is not intended to serve as a password that must be presented every time. Under Gimel ID’s concept, it is used when the digital identity is first established. The sample must be reliably linked to a verified person. Subsequent transactions use a digital identity credential and a cryptographic proof of possession, rather than another biological sample.
But what if someone obtains another person’s DNA, perhaps from a hair? The system cannot rely on the assumption that biological traces will remain inaccessible. A foreign DNA sample alone should not be enough to issue or use someone else’s digital identity. Controlled identity verification and an additional cryptographic proof of possession are also required. The specific technical implementation, laboratory procedures and privacy and security safeguards must be validated.
Gimel ID is intended to complement existing identity documents, such as national identity cards and passports, rather than replace them.
Who can do what – and for how long?
Gimel is developing two further components: Gimel Auth for authorizing digital systems and Gimel PQC for post-quantum security. Together, they address three distinct questions: Who is acting? What is that person or their AI agent authorized to do? And how can the relevant evidence be protected cryptographically?
When a task is delegated to another agent, its authority must not exceed that of the agent or person delegating it. Before a protected action takes place, the system checks the mandate, its validity and its limits. The decision is documented so that the basis for authorizing an action can be traced later.
This is particularly relevant when agents access sensitive data or trigger actions with financial or operational consequences, including in finance, healthcare, industry and public administration. The aim is not to slow down every routine task with manual approvals. Instead, routine operations should be automated within clear boundaries, while critical actions can require additional authorization.
Post-quantum cryptography is another important part of the approach. Sensitive data may need protection for decades, while attackers can collect encrypted information today in the hope of decrypting it in the future. Since migrating cryptographic systems can take years, organizations need to prepare well in advance.
From security concept to practical application
Gimel is working to turn its specified mechanisms into solutions that can be integrated into real-world systems. During beta testing, the team is examining how reliably its authorization checks prevent unauthorized actions while allowing permitted ones. Revocation, connection failures and the delegation of tasks must also work reliably. Security must hold up under adverse conditions, not just in a demonstration.
Gimel relies on open specifications and defined interfaces so that existing identity services and business applications can continue to be used. The authorization check is designed to operate where a relevant action is triggered, such as before data access or a transaction.
Gimel recently joined the CISPA startup community. CISPA supported the startup with its application for StartUpSecure Phase II, and the funding was approved by Germany’s Federal Ministry of Research, Technology and Space (BMFTR). The funding provides room to advance technical development and prepare systematically for practical deployment.
For Wehberg, one of the main challenges is translating technical complexity into clear customer value. Companies need to understand which concrete problem a solution addresses and how it can fit into their existing processes. The exchange with CISPA helps connect technological goals, development steps and commercial prospects.
Wehberg’s underlying principle goes beyond individual security mechanisms: trust does not mean granting unlimited freedom to act. People also work with responsibilities, mandates and approvals. AI agents need similarly clear rules—and technical controls that enforce them. Because the question is not only whether an AI provides a good answer. It is also what the system is actually allowed to do.
