# Dubai immigration explores agentic AI. The hard part is permission design

Dubai's immigration authority is exploring agentic AI for government operations. The announcement is worth reading carefully because it describes an investigation, not a production deployment.

On 24 August, the General Directorate of Identity and Foreigners Affairs – Dubai (GDRFA Dubai) said it had made a working visit to analytics company SAS. The programme included an agentic AI workshop and demonstrations involving passenger-flow analytics, digital twins, intelligent knowledge bases, monitoring tools and drones for maritime rescue. The [Emirates News Agency report](https://www.wam.ae/en/article/c1w8zox-gdrfa-dubai-sas-advance-government-services) does not identify a signed contract, live agent, deployment date, budget or measured service outcome.

That distinction matters. An assistant can retrieve information or draft a response. An agent can plan steps, call systems and cause changes. In immigration and border operations, those changes may touch identity records, case files, passenger movement and time-sensitive decisions. The main engineering question is therefore not whether a model can complete a task. It is which actions the system may take, with whose authority, and how the organisation can reverse a mistake.

## Exploration sits inside a wider government AI programme

GDRFA says the visit supports Dubai's annual plan for accelerating AI adoption and the Dubai Digital Strategy. It also follows the [Dubai AI Policy for Government Entities](https://www.protocol.dubai.ae/en/media-listing/news-events/hamdan-bin-mohammed-reviews-first-edition-of-dubai-state-of-ai-report-and-witnesses-launch-of-ai-policy-at-dubai-ai-week/), announced in April 2025. That policy sets a common governance direction built around explainability, human-centricity, interoperability and proactive regulation.

Dubai has since added a practical portfolio model. Digital Dubai's [AI Integration Matrix](https://www.digitaldubai.ae/knowledge-hub/publications/ai-integration-matrix-framework-for-government-organizations), released in April 2026, separates four kinds of system: internal agents, internal retrieval-augmented generation, external agents and external retrieval-augmented generation. Digital Dubai says it has used the framework to guide more than 100 AI systems across multiple sectors. That is an institutional claim about portfolio management, not evidence that every system is autonomous or publicly exposed.

The matrix is useful because it stops teams treating all AI projects as the same risk. An internal knowledge search tool and an external agent with write access to operational systems need different controls. GDRFA's possible use cases span that divide.

## Start with a narrow action boundary

Passenger-flow analysis is a sensible place to begin because it can produce recommendations without changing a traveller's record. A model might detect an unusual queue, estimate pressure at a checkpoint or suggest staff reallocation. A human supervisor can inspect the evidence before acting.

The risk changes when an agent can open a case, update a status, request more information or trigger a downstream workflow. Each tool call becomes an exercise of institutional authority. A generic service credential with broad access would make the model's effective permission set far larger than the task requires.

Use a dedicated identity for every agent and every environment. Grant access per tool and operation, not per database. A queue-management agent may read aggregated movement data and create a staffing recommendation. It should not inherit permission to view a complete immigration record simply because both systems sit on the same network.

This matches the direction of the US National Institute of Standards and Technology's [AI Agent Standards Initiative](https://www.nist.gov/artificial-intelligence/ai-agent-standards-initiative), which focuses on secure agent operation, interoperability and confidence in agents acting on behalf of users. NIST has not certified the GDRFA use case, but its framing is relevant: delegation needs a technical identity and a defined authority boundary.

## Put human approval at the consequence boundary

"Human in the loop" is too vague to be a control. The approval point should depend on consequence.

Low-risk steps can run automatically: retrieve a policy version, summarise a non-sensitive dashboard or draft an operational recommendation. A human should approve actions that change a person's record, alter eligibility, send an official notice, expose sensitive data or redirect a live operational process. Some decisions may need to remain entirely outside the agent's remit.

The approval screen must show the proposed action, the source data used, the rule or policy version, the expected effect and any unresolved uncertainty. An approve button beside a polished model summary is not meaningful oversight if the reviewer cannot inspect the evidence.

The same rule applies to escalation. A safe agent needs an explicit way to stop when records conflict, a source is missing, a tool returns an unexpected result or the requested action exceeds its mandate. Silence should not be interpreted as permission.

## Treat data readiness as an operating dependency

Agentic systems amplify weak data. A wrong field in a dashboard may mislead one analyst. The same field connected to an automated workflow can create repeated actions at machine speed.

Digital Dubai's updated [Dubai Data Manual](https://www.digitaldubai.ae/newsroom/news/dubai-strengthens-its-digital-leadership-with-the-launch-of-the-updated-dubai-data-manual) covers data quality, governance, roles, responsibilities and compliance. Its stated aim is consistent, structured and AI-ready government data. For an operational agent, those requirements need runtime enforcement rather than a one-time readiness review.

Every source should have an owner, freshness threshold and permitted purpose. The agent should know whether a value is authoritative, derived or advisory. If a passenger-flow feed is delayed, the system should expose that delay and disable actions that depend on current conditions. If two identity sources disagree, it should route the case rather than choose the answer that looks most plausible.

Sensitive content also belongs outside ordinary application logs. Keep correlation IDs, tool names, policy decisions, timestamps and result codes in the operational trail. Store restricted payloads behind tighter access controls. SultanByte's guide to [privacy-safe application logging in Saudi Arabia and the UAE](https://www.sultanbyte.com/privacy-safe-application-logs-saudi-uae) describes the same separation for conventional systems; agents make it more important because a single task can cross several tools.

## Test the workflow, not only the model

A high benchmark score does not prove that an agent is safe inside a government process. The test unit is the full chain: user request, retrieved context, plan, tool selection, permissions, API response, approval and final state.

The [NIST Generative AI Profile](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence) recommends structured risk management across governance, mapping, measurement and management. The newly published [OWASP GenAI LLM Top 10 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/) adds application-security failure modes that teams can turn into adversarial tests.

For a public-service agent, the test set should include malicious instructions inside uploaded documents, stale policies, ambiguous names, duplicate records, partial outages, rejected tool calls and a model attempting a higher-privilege action after a lower-privilege step fails. Run the same cases after any model, prompt, retrieval index, tool schema or policy change.

Production monitoring should measure more than answer quality. Track attempted and blocked actions by permission, human override rates, unresolved cases, stale-data stops, rollback frequency and the time taken to reconstruct an agent's path. A service can look accurate in aggregate while repeatedly failing on the cases with the highest consequence.

![Six control gates for a government agent: scope, identity, data, tool permissions, human approval, and audit plus rollback](https://cdn.hashnode.com/uploads/covers/60ecf4a0fc37a15ec15655e8/7ba81575-0382-4650-ab20-9e8789ccd2ac.png)

*Six gates before a public-service AI agent may act. Sources: GDRFA Dubai/WAM, Digital Dubai AI Integration Matrix and Data Manual, NIST AI Agent Standards Initiative and AI RMF, OWASP GenAI LLM Top 10 2026. Credit: SultanByte editorial artwork.*

## A credible pilot should be easy to stop

GDRFA's workshop signals interest in agentic operations, but the public record does not yet establish a deployed system or outcome. That is the right moment to set the operating rules.

Begin with one bounded workflow whose action can be reversed. Give the agent its own identity, read-only access by default and an explicit list of permitted tools. Place approval before any consequential change. Log the plan and every attempted action. Then test rollback before measuring time saved.

If a pilot cannot show who authorised an action, which data supported it and how to undo it, it is not ready for an immigration or border workflow. Autonomy should expand only after the controls have survived real exceptions, not because the demonstration handled the happy path.