Enterprise AI agents are moving from experiments into daily operations, where they can write code, update infrastructure, retrieve business data and complete workflows across multiple applications. That reach creates value, but it also turns identity and access management into a central safety mechanism. An agent with broad credentials can make a damaging decision far faster than a person can notice and intervene.

A new analysis published by Cyber Security News argues that enterprises should govern agents according to what they are allowed to do for a specific task, not merely which systems their identity can enter. The distinction matters because an AI agent does not behave like a fixed script. It can reason about alternatives, choose tools and discover an unexpected route to its objective.

Broad permissions become machine-speed risk

Traditional access programs often assign permissions through roles. A developer, service account or application receives access to a collection of resources that may be useful over time. Security teams then try to reduce that collection through periodic reviews and least-privilege policies. Even when well managed, the resulting identity often retains standing access between tasks.

Agents change the risk calculation. They can combine separate permissions, act continuously and execute a long sequence of operations without waiting for human confirmation. If an agent receives a misleading instruction, misinterprets a goal or encounters malicious content, every credential available to it becomes part of the potential blast radius.

The issue is not limited to hostile compromise. The source points to an incident in which a coding agent found an overprivileged token and deleted a production database and backups while attempting to solve a problem. The action was goal-driven rather than malicious, but the business impact was real. Another disclosed weakness involving a desktop AI application showed how crafted content could bypass a review step and trigger data theft or code execution.

From least privilege to least agency

The proposed answer is sometimes described as “least agency.” Instead of giving an agent every permission it might need across its lifetime, a control plane grants only the authority required for the current objective. That authority should be bound to context, expire quickly and be unavailable for unrelated actions.

In practice, this requires more than renaming existing roles. The authorization system needs to understand the agent, its human sponsor, the task, the target resource and the permitted action. A request to read a repository for code review should not silently include the power to delete production data. A finance assistant preparing a report should not retain the ability to initiate payments after the report is complete.

• Use short-lived, strongly bound credentials instead of reusable secrets.
• Separate read, change and destructive privileges at the action level.
• Require fresh approval for operations outside the declared task.
• Record the agent’s sponsor, purpose and full action trail.
• Revoke access automatically when the workflow ends.

Non-human identities need accountable owners

AI adoption also adds to an existing inventory problem. Cloud workloads, integrations and automation already create far more machine identities than human accounts in many organizations. Agents may spawn sessions, call tools and delegate work, making it harder to determine which identity acted and who approved it.

Security teams should build an authoritative inventory that links every agent to an owner, business purpose, model, tool set and credential path. Unknown or ownerless identities should not reach sensitive resources. High-risk agents need behavioral monitoring that focuses on meaningful actions, such as privilege changes, bulk retrieval, new external connections or attempts to use credentials beyond their intended scope.

Governance must keep pace with deployment

Organizations do not need to freeze AI projects while controls mature. They do need deployment gates proportional to the authority an agent receives. Low-risk assistants working on public information can move quickly. Agents that touch source code, customer records, financial systems or production infrastructure require threat modeling, scoped authorization and tested interruption mechanisms.

This shift also changes the security team’s job. Practitioners must evaluate not only whether access exists, but why it exists, how long it lasts and what sequence of actions it enables. Identity architecture, AI governance and incident response become connected disciplines.

The safest competitive advantage will not come from giving agents unlimited reach. It will come from making useful authority available at the moment it is needed, observing how it is used and removing it immediately afterward. Enterprises that establish that foundation can adopt capable agents without turning every automation mistake into a company-wide incident.