An employee asks an AI agent to resolve a customer billing problem. To complete the task, the agent needs to retrieve the customer record, access billing information, update the account, and perhaps issue a credit. The employee is authorized to do all of those things. How much of that authority should transfer to the agent?
That question gets even more difficult to answer as agents take on more complex work. An agent may need different permissions at different stages of a task, invoke tools or APIs, hand work to another agent, or encounter conditions that change what it should be allowed to do. Giving the agent an identity and a set of permissions does not address those questions.
For now, enterprises are containing that uncertainty with human control. In theCUBE Research’s AI Cybersecurity and Resilience Study, 12 of the 25 enterprise security, IT and technology leaders we interviewed reported bounded autonomy, with human review reserved for higher-impact actions. Seven require explicit human approval for every agent action. None reported unguarded autonomous agents performing high-risk actions.
Human control gives organizations a practical way to limit risk while agent deployments remain relatively constrained. It will become impractical to sustain as organizations deploy more agents, expand the work assigned to them, and expect more tasks to be completed without intervention. Routing consequential actions back to people also limits some of the efficiency and scale organizations expect from agentic AI.
This article is part of a series exploring how AI governance changes established security and resilience domains. We previously evaluated data governance and how AI changes the practical meaning of authorized access. Identity presents a related challenge: translating human or business authority into boundaries an agent can operate within.
That requires controls over more than the agent’s identity. Organizations need to determine the scope and duration of its authority, the conditions under which that authority applies, what can be delegated to another agent or tool and what evidence must be preserved after the agent acts.
Five dimensions define that control problem: identity, entitlement, conditions, delegation and accountability. Together, they provide a path for moving some of the control now exercised through human intervention into technical enforcement as agent autonomy grows.
IDENTITY: Know Which Actor Is Acting
The first requirement is being able to distinguish the agent from the person or process behind it.
Organizations in our study are extending existing identity approaches to agents through service accounts, human user identities, and existing IAM platforms. Eleven of 25 respondents reported agent identity at one of the two implemented levels, while eight were at the planning stage or had not addressed it.
The problem becomes clear when an agent inherits a human identity. An employee may be authorized to access customer records, contracts, and internal financial information. An agent operating under that employee’s identity may inherit the same permissions. If it modifies a customer record and the log captures only the employee identity, investigators can see whose credentials were used without being able to tell whether the employee or the agent made the change.
Each production agent therefore needs an explicit identity, an accountable human or organizational owner, and activity that can be distinguished in logs. Credential lifetime matters too. An identity created for a temporary task should not become a standing source of access.
The objective is a record that preserves both actors: the agent that performed the work and the human or business process on whose behalf it acted.
ENTITLEMENT: Scope Authority to the Task
Once the agent’s identity is established, the organization needs to determine how much authority it should receive.
Agent authorization and least privilege are slightly further along than agent identity in our study. Thirteen of 25 respondents reported authorization and least privilege at one of the two implemented levels, with another seven reporting partial implementation.
One respondent described testing an agent whose intended use case eventually required both read and write access. As its permissions expanded, so did the potential blast radius and the difficulty of approving the agent for production.
That is the weakness in treating an agent like another service account. A standing role can give an agent everything it might need across many tasks. The authority required for a particular task may be much narrower.
An agent could receive read access for one workflow, limited write privileges for another, and an approval requirement before a higher-impact action. Authority can expire when the task ends and can be constrained by the number of records affected, systems reached or transactions initiated.
The principle is to give the agent only enough authority to complete the assigned work, for as long as that work requires it, within a defined scope.
CONDITIONS: Govern Authority as the Task Unfolds
Even narrowly scoped authority can become inappropriate when the circumstances change.
Consider an agent authorized to update customer records. Changing one customer’s address and changing 10,000 customer records may invoke the same application permission. The operational risk is very different.
A runtime decision therefore needs more than identity and entitlement. Business purpose, task, human sponsor, data sensitivity, requested action, current system state, blast radius, and reversibility can all impact whether an action falls within acceptable boundaries.
This creates a basis for risk-tiered authorization. A routine, reversible action can proceed within established limits. A sensitive or high-impact action can trigger narrower authority, additional authorization or human review.
Because agent behavior is dynamic, those controls also need to operate while the task is underway. An agent can begin inside its approved boundaries and encounter new information, a different system state, or an action with greater consequences than anticipated when the task began. In other words, what the agent was allowed to do at the start of a task cannot automatically determine everything it may do until the task is complete.
DELEGATION: Trace Where Authority Travels
The problem expands again when one agent hands work to another. A human authorizes Agent A to complete a business task. Agent A delegates part of that work to Agent B, which invokes another agent, an API or an external tool. The original authority has now traveled across several actors and systems. Each handoff needs its own boundary.
Authority attenuation helps to ensure that the downstream actor receives only the authority required for its portion of the task. Agent B should not automatically inherit the full authority granted to Agent A simply because Agent A initiated the request.
The delegation record should preserve the human sponsor, originating agent, downstream actors, credentials used, assigned task, duration and authority granted at each step. APIs and Model Context Protocol connections add another layer because they extend agent authority into enterprise systems and tools. Without that chain, the enterprise may know which identity executed the final action while losing the path that explains how that identity acquired the authority to do it.
HUMAN APPROVAL: Control the Transition to Greater Autonomy
Human approval is carrying a significant share of agent governance today. It gives organizations a clear decision point before an agent takes a consequential action, even when the technical controls surrounding agent authority are still developing.
Our research suggests that this approach has limits. Organizations using bounded autonomy were more likely to report confidence in reconstruction and remediation and to have tested agent incident scenarios than those requiring approval for every action. The groups are small, 12 organizations using bounded autonomy and 7 requiring approval for every action, so we treat the pattern as directional.
Three respondents relying on explicit human approval also acknowledged recovery gaps if that control failed, including an inability to roll back agent actions and difficulty reconstructing what an agent had done.
Taken together, the findings raise an important question about the role of human approval as agent adoption expands. A person can decide whether to authorize a sensitive action. That decision does not create the technical evidence needed to trace the action, contain its effects or recover from an incorrect outcome.
As organizations grant agents more autonomy, human review will remain appropriate for some consequential decisions. More of the routine control burden, however, will have to be carried by technical mechanisms that can scope authority, evaluate the conditions of an action and preserve evidence of how that authority was used.
ACCOUNTABILITY: Preserve the Chain of Authority
The enterprise eventually has to answer a deceptively simple question: Why was this agent allowed to do that?
Today, many organizations would struggle to reconstruct the answer. Only eith of 25 respondents reported monitoring and reconstructing agent activity at one of the two implemented levels. Our study also found gaps in correlating agent activity across destination systems and understanding the context behind an agent’s decisions.
For a consequential action, the record should establish which agent acted, which human or business process sponsored the activity, which credentials were used, what authority was granted, what task the agent was performing, whether authority was delegated, and which systems were affected.
That evidence becomes especially important when an agent produces the wrong outcome using valid credentials. Authentication may have succeeded. The application may have confirmed that the identity had permission. Neither tells investigators whether the agent should have exercised that authority under those circumstances or how the authority reached the actor that ultimately used it. Accountability therefore depends on preserving the chain of authority, not simply the identity at the end of it.
TRACE ONE AUTHORITY CHAIN
IAM, PAM, zero trust, RBAC, ABAC and non-human identity programs give organizations much of the foundation they need. Agentic AI adds the requirement to connect those controls to task-level authority, runtime conditions, delegation and accountability.
Organizations should begin with one consequential production workflow.
Trace the human or business process sponsoring the work, the agent identity, credentials and entitlements involved, the authority granted for the task, the conditions that constrain it and any downstream delegation. Then follow the evidence the workflow leaves behind.
Now assume the agent takes an incorrect action using valid credentials and permissions. Can the organization establish who acted, on whose behalf, what the agent was authorized to do, whether those conditions still applied when it acted and where its authority traveled along the way? Wherever that chain disappears, you have found a control gap.
