Joel Burleson-Davis is the CTO at Imprivata, where he’s responsible for building, delivering, and evolving cybersecurity products.
Without a doubt, we are in a new era of autonomous, agentic AI. What began as generative AI tools designed to assist humans is rapidly evolving into something more powerful: AI agents capable of taking action, initiating workflows and making decisions within complex systems.
For most of us, the shift is both exciting and deeply uncomfortable. While this tension is not limited to any one industry, it is heightened in high-stakes environments, such as healthcare and critical infrastructure, where the risk of real-world consequences intensifies the pressure of getting it wrong. But discomfort, in this case, is not a signal to slow down. It’s a signal to get smarter about how we move forward.
The Shift From Analysis To Action
Traditional AI lived in the background, analyzing data, surfacing insights and supporting human decisions. Agentic AI steps into the foreground with the ability to recommend and execute actions autonomously. This has effectively expanded both workforce capabilities and risk.
To add to that, adoption is accelerating quickly. A 2025 McKinsey study found that 62% of respondents said their organizations are at least experimenting with AI agents, with 23% scaling them in their enterprise.
In lower-risk environments, this may look like efficiency gains or automation at scale. In critical industries, it raises more urgent questions. The moment AI moves from passive assistant to active participant, the rules change. The question is no longer “What can AI do?” but “What should AI be allowed to do—and under whose authority?”
Working Through The Discomfort
In conversations with customers, partners and even my own team, I keep hearing the same pattern: People recognize that AI is becoming an integral part of how work gets done, but many are uneasy about what that means. They see its potential to reduce burden and help teams operate at scale. At the same time, they’re wrestling with harder questions around authority, oversight and trust.
That discomfort is rational. We know how to trust people because we understand the frameworks around them. AI doesn’t fit neatly into those same mental models. It can influence decisions, initiate workflows and operate with increasing autonomy, but without the human context we instinctively rely on.
This is the uncomfortable reality: AI is advancing faster than our traditional models of governance and accountability are adapting to it. Still, resisting or avoiding the technology adoption wave is not a viable strategy.
The answer is not denial. It’s discipline. We must become comfortable with the uncomfortable by being clearer about authority, accountability, identity and control.
AI Agents And Expanding Risk: The New Insecurity Layer
Every AI agent introduced to the environment brings a new identity, new permissions and new opportunities for misuse or error, especially when adoption outpaces governance. This creates a new layer of insecurity. The risks are familiar in one sense, but amplified in another: over-provisioned access, credential sprawl, weak attribution, privilege escalation and automation operating at a speed and scale that can magnify mistakes. In some industries, that may mean operational disruption or data exposure. In critical sectors, it can impact safety, continuity and trust.
To address this, businesses must first stop treating AI agents like background automation and start treating them like identities that need to be governed with intention.
The Role Of Identity And Ownership
The first practical step is straightforward: Every AI agent should have its own unique, verifiable identity. No shared accounts. No invisible automation. No hardcoded credentials passed across systems.
That identity should live inside existing identity and access management (IAM) and security frameworks, not outside them. It should be authenticated through approved enterprise controls, linked to a defined purpose and tied to a human owner responsible for its use, oversight and review.
Once an agent is uniquely identified and clearly owned, it becomes much easier to answer the core questions of accountability, such as: What is this agent supposed to do? Where is it allowed to operate? Under whose authority? That clarity is foundational to trust.
Building Confidence Through Visibility And Governance
Agentic identity management must extend beyond provisioning. Organizations need visibility into what agents are actually doing, not just what they were permitted to do.
That means logging agent activity with clear attribution, distinguishing machine actions from human actions and monitoring for unusual behavior, unexpected access patterns or actions outside normal workflow context. It also means governing the full life cycle—from approval before deployment and regular access reviews, to ongoing adjustments and decommissioning when the agent is no longer needed.
This is how enterprises get comfortable with the uncomfortable. Not by waiting for uncertainty to pass, but by establishing identity, accountability and control around a form of technology that is becoming more capable. In this era of change, confidence will come from managing AI agents with the same rigor we expect from any human.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?