Krishnaveni Palanivelu, SVP Cybersecurity Architect, Financial Services.
For the past two years, most enterprise conversations about AI have centered on generation: models that draft text, summarize documents or suggest a snippet of code. That era is giving way to something more consequential. Agentic AI—autonomous systems that can plan a task, write and test code, call APIs, and deploy changes with limited human intervention—is moving out of pilots and into production. In software engineering alone, autonomous agents are beginning to take on work that used to require an entire team.
AI Is Moving From Answers To Actions
This shift is exciting, and it is also a different security problem. For most of the AI wave, the risk we managed was what a model would say. With agentic AI, the risk is what a system will do. An agent does not just produce an answer; it takes actions inside your environment, against your data, with real consequences. That single change, from generation to action, is why the security model that served the last wave will not carry us through the next one.
Having led security architecture for large, regulated financial platforms, I have watched capable teams reach for their existing playbook and find that it does not quite fit. Treating an autonomous agent as just another application behind an API gateway underestimates what it can do. The good news is that securing agentic AI does not require inventing a new discipline. It requires applying a few familiar principles with unusual deliberateness, and building them in from the start rather than adding them after something goes wrong. Here is the control baseline I would put in place before letting an autonomous agent anywhere near production.
1. Treat The Agent As An Accountable Identity, Not A Tool
The most useful shift is to stop thinking of an agent as software and start treating it as a non-human actor that must be governed like any privileged identity. Give it a distinct, named identity. Scope its permissions to the specific task rather than to a broad service account it inherits by default. Apply least privilege without exception, and make sure every action it takes is attributable back to that identity. If you cannot answer the question of “Who did this, and were they allowed to?” then you are not ready to deploy.
2. Keep Humans In The Loop Where It Matters
Autonomy is the point of these systems, but unbounded autonomy in a regulated environment is a liability. The discipline is to decide, in advance, which actions require human review before they take effect and to build those gates into the workflow rather than relying on people to remember to check. Code moving toward production, changes that touch sensitive data and any action with irreversible consequences should pass a human review gate. This is not about slowing the agent down everywhere; it is about placing friction precisely where the cost of a mistake is highest.
3. Build The Controls In From The Start
Security by design is an old idea, but agentic AI makes it urgent again. Run the agent in an isolated, sandboxed environment so that what it produces is created and tested without touching live systems until it has cleared review. Put explicit guardrails on what it is permitted to attempt. Decide up front how it authenticates, what it can reach and what it must never reach. Retrofitting these controls after a deployment is already live is far harder, and far riskier, than designing them in from day one.
4. Make Everything Auditable
When an autonomous system is taking actions on your behalf, logging is not a convenience; it is the mechanism that keeps the system under accountable human control. Every action the agent takes, every change it proposes and every resource it touches should be recorded in a form your own auditors and your regulators can review. The goal is a complete, tamper-resistant trail that lets you reconstruct exactly what happened and demonstrate that AI-driven activity stayed within its boundaries. In regulated sectors, this is often the difference between a technology you can adopt and one you cannot.
5. Agree On A Control Baseline Your Risk And Compliance Partners Will Accept, Before You Scale
The fastest way to stall an agentic-AI program is to build it in isolation and present it to risk leadership at the very end. The better path is to define—together with your security, risk and compliance functions—the baseline of controls an agent must meet to operate and to map that baseline to the frameworks you already use. Do not treat AI as exempt from the standards you apply to everything else. When the baseline is agreed early, each new agent inherits it, and the cost and risk of every additional deployment falls rather than rising.
Autonomy And Accountability Must Scale Together
None of these principles is exotic. What is new is the discipline of applying them to a system that acts on its own. The organizations that get the most from agentic AI will not be the ones that move fastest with the least control, and they will not be the ones that freeze out of caution. They will be the ones that treat security as a design input from the first day, so that autonomy and accountability scale together.
Agentic AI is going to reshape how software is built and how work gets done, and it will do so faster than most governance processes are ready for. That is precisely why the security model has to lead rather than follow. Decide how you will give these systems identity, oversight, isolation, auditability and an agreed control baseline before they are running in production, not after. Get that foundation right and you can adopt this technology with confidence instead of fear. Get it wrong and the speed you gained will be the least of what you lose.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?