Nidhi Jain is CEO & Founder of CloudEagle.ai, an AI governance platform that secures AI agents, machine identities, and SaaS access.
In July 2026, the U.K.’s AI Security Institute disclosed that AI agents under evaluation had taken sustained, unsanctioned action against real people and organizations. In the most serious case, an agent researched the maintainers of a public open-source project on GitHub, created multiple fake identities and attempted to socially engineer a maintainer into approving a malicious pull request. The maintainer rejected the code. AISI detected unusual network traffic on July 28 and contained the incident within an hour of the alert.
Many enterprises deploying Salesforce Agentforce, Microsoft Copilot Studio, ServiceNow Now Assist, Google Vertex AI Agents and AWS Bedrock lack these safeguards.
Gartner predicts that 40% of enterprise applications will feature task-specific AI agents by the end of 2026, up from less than 5% in 2025. The Cloud Security Alliance found that 65% of enterprises have already experienced an AI agent-related security incident, and 82% have unknown AI agents running in their environment.
Blocking is not the answer. The question is what guardrails let adoption and security coexist.
What Makes AI Agent Security Different From Traditional Access Control
In almost every conversation I have with a CISO rolling out agents, the same assumption shows up: Governance is a Phase 2 problem. Deploy first; govern later. The CSA data shows what Phase 2 actually looks like.
AI agents break traditional access models in three ways:
• They inherit the deploying user’s permissions instead of their own scoped identity. A Salesforce Agentforce agent built by a sales ops lead inherits the sales ops lead’s full access. The agent runs with permissions it never needed.
• They act across systems through delegated OAuth. A ServiceNow Now Assist agent connected to Jira, Confluence and Slack holds OAuth tokens to all three. One compromise reaches four systems.
• They persist beyond the use case. CSA reported that only 21% of enterprises have formal decommissioning processes for AI agents. Most keep running long after the use case ends, with credentials still valid.
How To Secure AI Agents Before Production Deployment
Most CISOs I speak with are being asked to approve agents already in late-stage pilots. The checklist below is designed around one principle: Friction scales with risk.
Low-risk actions get no friction. High-risk actions get human review. The business keeps its speed; security keeps control over actions that matter:
1. Require a scoped-access review for every agent before deployment. The agent gets its own identity, scoped to the specific task. Microsoft Copilot Studio and Salesforce Agentforce both support agent-level identities, but most teams default to user inheritance.
2. Define human-in-the-loop checkpoints for high-risk actions. Reading data: no checkpoint. Writing to a record of truth, moving money, sending an external communication or modifying production configurations: human approval before execution. This is a policy decision, not a technical one.
3. Mandate audit logging at the action level, not the prompt level. Prompt logs show what the user asked. Action logs show what the agent did across every system it touched. For AWS Bedrock Agents, Google Vertex AI and Anthropic Claude agents, action-level logging has to be configured at deployment, not retrofitted.
4. Set an expiration date for every agent. If the agent is still useful in six months, renew it with a fresh access review. If not, decommission. This single control closes the retirement debt CSA flagged.
How To Audit AI Agents Already Running In Your Environment
If agents are already live, discovery comes first:
1. Pull an inventory from every agent platform in use. Microsoft Copilot Studio, Salesforce Agentforce, ServiceNow Now Assist, AWS Bedrock, Google Vertex AI and any custom LangChain or CrewAI deployments. Admin consoles expose this; most security teams have not pulled the reports.
2. Cross-reference OAuth grants with agent identities. Grants to unfamiliar app IDs, especially those tied to AI model providers, are candidates for review.
3. Classify agents by action risk. An agent that reads Jira tickets is a different control problem than an agent that posts to customers or writes to the general ledger.
4. Revoke access for orphaned agents. When the builder leaves, the agent does not. If no human owner can be named, the agent is orphaned, and orphaned agents are retired.
Common AI Agent Governance Challenges (And How To Address Them)
There are three common objections when starting this work. The first is that guardrails will slow business adoption. They do not have to if they are designed around the risk of each action: Read-only agents can operate at full speed, while agents that write back to systems require approval. This preserves productivity across most use cases.
The second objection is that organizations cannot audit activity they cannot see. Yet the admin consoles for Microsoft, Salesforce, ServiceNow, AWS and Google already expose agent activity. In many cases, organizations simply have not enabled the relevant logs.
The third is that no one owns agent governance. Responsibility often falls between security, IT, legal and the business function that deployed the agent. Organizations making the most progress assign a cross-functional AI governance lead who reports to the CISO.
What AI Agent Vendors Should Do Differently
The agent platforms have shipped faster than their security defaults can keep up.
Vendors should ship agents with least-privilege defaults, not broad inheritance. Action-level audit logging should be on by default. Decommissioning workflows should exist natively in every agent platform. Although frameworks such as the OWASP Agentic AI Top 10 and NIST AI RMF offer useful guidance, they stop short of making agent governance a core security requirement rather than an operational consideration.
The Future Of AI Agent Governance In The Enterprise
The next AI agent incident will not look like a misconfiguration. It will look like an agent executing exactly what it was permitted to do, using credentials it inherited, with no human in the loop to catch the error.
Guardrails and adoption are not in opposition. The companies that figure out the balance now will be the ones setting the pace on AI agents in two years. The ones treating it as a trade-off will spend those two years explaining incidents instead of shipping agents.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?