Praerit Garg, CEO, One Identity, trusted leader in identity security, helping enterprises protect and simplify access to digital identities.
An employee might spend an afternoon retrieving customer records or checking account details. Meanwhile, an AI agent might tick off those tasks within seconds, then repeat them thousands of times without pausing. We’ve reached a golden age of automation, where AI can do more than just automate—it can make decisions and act upon them at speeds that even a whole team of humans could fail to match.
But there’s a catch. While every individual action performed by an AI agent may fall within defined permissions and parameters, all it takes is one excessive entitlement or poorly designed approval process for an AI to cause significant damage. And because AI makes automation much simpler to achieve, allowing employees to turn existing permissions into powerful automated workflows with a single prompt, it’s becoming much harder to govern. With McKinsey reporting that up to 40% of organizations are already scaling an agentic AI system in at least one business function, this is quickly becoming one of the year’s defining security issues.
Much of the industry’s response has focused on building entirely new identity and governance architectures specifically for AI agents, but they actually already have the right tools at their disposal in the form of identity governance and administration (IGA) and privileged access management (PAM). The same questions that are asked of humans should be asked of machines: Whose authority is the agent exercising? What information can it access? Which actions can it take, and when should additional approval be required? Instead of rebuilding governance architectures from the ground up, businesses simply need to refocus the tools and learnings already at their disposal, particularly zero-trust architectures.
Microsoft made a significant investment in exploring a more code-centric approach with code access security (CAS) some 25 years ago, but the company later deprecated it and no longer treats CAS as a security boundary because too many paths can allow privileges to be elevated. Microsoft now directs developers toward enforceable operating-system boundaries, including user accounts, which reinforces the idea that creating a specialized control layer doesn’t necessarily provide stronger protection than applying established security boundaries consistently.
A Familiar Problem Dressed In Unfamiliar Technology
I was recently introduced to an elaborate access governance system designed specifically to stop AI agents from taking actions their users never intended. The organization’s concerns were legitimate, of course, but the solution their team proposed, like Microsoft’s, added so much complexity that they didn’t even consider they may already have the answer.
An agent acting on someone’s behalf should, at most, only be able to use the permissions granted to that user. If an employee can view a customer record but can’t export an entire database, an agent working for that employee should also have the same limitations applied to it. If the agent can approve a payment or gain access to another business function that the user could not, the first question should be why those permissions were available in the first place.
Where We’ve Encountered This Situation Before
The early internet created a similar “trust crisis.” As businesses began distributing software online, users had no easy way to know who had created a program or exactly what it would do once installed. Worms such as Code Red and Nimda showed how quickly malicious code could spread when software was allowed to move and execute across connected systems. That’s when the industry decided that a form of trust infrastructure should be built around digital signatures, certificates and policies, which governed which software was allowed to run.
Step back into 2026, and the same story is unfolding. Organizations need to establish where an agent and its underlying model came from, authenticate the identity it uses, restrict the systems and data it can reach and require approval before any actions are performed. A trusted model may reduce the risk of deliberately malicious behavior, but identity controls (based on least privileged and zero trust principles) still provide the enforceable boundary when prompts are ambiguous, permissions configurations are flawed or an agent reaches an “unintended” conclusion.
Governing The Machines
AI magnifies the consequences of every single entitlement decision. A permission that posed a manageable risk when exercised occasionally by an employee can pose a greater risk when an agent uses it continuously across thousands of tasks. It’s up to humans to assess whether those permissions are still appropriate, what limits should apply and when additional approval is needed. PAM already provides the means to control and audit privileged access according to those decisions, helping organizations put their assessment of business risk into practice.
Each autonomous service simply needs to have its own identity, a clearly defined supervisor and permissions tied to its specific “role.” In a multi-agent workflow, one agent might retrieve customer data while another updates a business system. Giving both access through the same broad credential would make it difficult to determine which agent performed an action or revoke one agent’s access without disrupting the entire workflow. Existing IGA and PAM capabilities can provide that accountability, provided they’re equipped to govern all identities continuously and revoke access at machine speed.
AI is new and exciting, but we need to move away from the idea that an agent’s ability to reason about an action gives it the authority to perform it. That decision must remain external to the model and enforceable through the identity infrastructure.
Why Machine Speed Requires Tighter Governance
There’s no escaping the fact that AI agents will become more capable, more autonomous and more deeply embedded in everyday business operations. Every one of those agents must act through an identity, exercise permissions and encounter moments when additional authority is required. As agents become more capable, every organization should be able to explain which permissions were granted, on whose authority and, ultimately, who is accountable for their actions.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?