Artificial Intelligence (AI) is entering a new phase. AI-powered agents are now acting on behalf of users, executing workflows, accessing enterprise applications, retrieving sensitive information, and interacting with customers and business processes autonomously. A call promoting a property launch, credit card or loan offering may sound familiar, but the voice on the other end is an AI-powered agent rather than a human representative.
This evolution towards an agentic enterprise presents opportunities for productivity and innovation. However, it also raises a fundamental security question: What should an agent be authorised to do? As organisations seek to harness the benefits of agentic AI, answering this question will be critical to achieving their Apex Advantage.
An agent that can access customer records, approve transactions, modify configurations or initiate business processes without appropriate controls can introduce risks comparable to those posed by privileged human users. Unlike humans, agents can operate continuously, at scale and at machine speed. A permission granted to an employee may result in tens of actions per day; the same permission granted to an autonomous agent could result in thousands of actions within minutes. This can amplify both business value and organisational risk.
In the era of agentic AI, identity is becoming the primary control plane for trust, accountability and security. Organisations that fail to establish appropriate governance around agent identities, permissions and decision-making authority may find that their newest insider risk is not human at all.
Controlling what agents can do
Much of the current discussion around agentic AI focuses on the intelligence of these systems: how effectively they reason, plan and complete complex tasks. However, the more pressing enterprise concern is authority. An organisation’s risk profile is governed by what an agent is authorised to do.
A customer support agent that can summarise account information presents a different risk profile from an agent that can update customer records. Likewise, an agent that recommends a financial transaction presents significantly less risk than one that can execute the transaction independently. The distinction is critical.
Intelligence enables capability. Permissions enable action.
Access for employees, contractors, vendors and service accounts is governed through policies, roles, approvals, segregation of duties, monitoring and periodic review. These controls exist because trust alone is not a security model.
The same principle must apply to AI agents. Every agent should operate with a clearly defined identity, explicit permissions and bounded authority. This keeps autonomy aligned with organisational policies, risk tolerances and regulatory obligations.
The emerging insider risk
Autonomous agents present a new class of insider risk because they can access systems, process information and execute actions using delegated authority.
Malicious instructions embedded in emails, documents, websites or external data sources can manipulate agents into performing unintended actions using legitimate credentials, making detection difficult.
Organisations face five critical governance risks when deploying AI agents: unmonitored actions (invisible agency), excessive authority (unbounded delegation), blind access to tools (credentials without context), unpredictable changes in behaviour (behavioural drift) and undefined liability (broken accountability). Collectively, these challenges obscure what agents are doing, why they are doing it, and who is ultimately responsible for the outcome.
Governing AI agent identities
A pragmatic governance approach centres on three questions: What can an AI agent access? What can it do? Who can authorise its actions? Answers must be formally established and enforced.
For example, an agent’s access to data and apps must be strictly restricted to what it needs for the job. It should never perform risky actions without explicit authorisation, and its activity must be constantly monitored and reported using identity and access management protocols. The core principle is simple: authorise the specific task and never give unrestricted access. Every agent should have a defined identity, explicit permissions, a business owner and a clearly bounded mandate.
Organisations should assume that agent credentials may eventually be compromised. Continuous monitoring, auditable activity logs, anomaly detection and the ability to rapidly revoke permissions are therefore critical for agents. Credentials and secrets should remain outside the agent’s reasoning context, with human oversight retained for high-risk activities.
Securing the agentic enterprise in a regulated world
In regulated industries such as banking and insurance, agent errors can directly affect customers through unauthorised account changes, incorrectly processed claims or inappropriate disclosure of confidential information. Existing regulatory expectations around access control, accountability, auditability and third-party risk must therefore be extended to autonomous agents.
Across banking, insurance and customer service frameworks, the operational baseline rule is consistent: make agent activity attributable, bounded and auditable. Human accountability must be preserved whenever automated actions materially affect an individual’s money, policies, investments or rights.
The executive mandate
For enterprises, the apex advantage will lie in turning agentic AI into a source of business value through better decisions and faster execution. The measure of enterprise AI maturity will be the organisation’s ability to demonstrate that every agent has a legitimate identity, a bounded mandate and traceable authority and that permissions can be withdrawn quickly and completely before risk becomes impact.
Authored by Anand Venkatraman, Partner, Deloitte India
