“ The policy and the way work gets done are often developed separately. Security sets a rule about what AI may access. Meanwhile, the business is asking teams to use AI to do real tasks under real deadlines.”

When security requirements are not embedded into operational systems, employees may have to choose between granting agents broad access and delaying business activities.

“ A document cannot refuse a database query or end a session,” he said.

Effective governance requires enforceable technical controls. Agents should receive only the permissions necessary for their tasks, with requests evaluated continuously and access withdrawn when the work is completed.

Ayad illustrates the risk through an agent investigating a failed customer payment. Although it may legitimately need to query a payments database, that does not justify retrieving every customer record.

“ Its credentials might allow both requests, but only one serves the task. A log can tell you later that the second query happened. A decision made before it runs can stop it.”

Why runtime control matters

Traditional identity and access management remains essential for authenticating agents, establishing ownership and determining permissions. However, authentication alone cannot establish whether subsequent behaviour remains appropriate.

“ An agent may start with a legitimate task and then take a turn nobody expected. So, I would build on existing identity controls by asking what each request is for and whether it belongs to the work that was approved.”

Runtime control addresses this challenge by evaluating individual actions as they occur, allowing organisations to approve, reject or escalate requests according to context and risk.

Consider an agent investigating a service outage. Reading system logs may be appropriate, but changing a production configuration introduces greater risk. Before permitting that change, organisations should establish whether the action is justified.

“ We might allow the action, refuse it or ask a person to approve it.”

Runtime controls also protect against agents behaving unexpectedly despite possessing legitimate credentials. A compromised agent may authenticate successfully, with the warning sign being a change in its activities.

Continuous evaluation becomes particularly important when agents encounter malicious instructions embedded in documents, emails or websites.

Managing mistakes and malicious behaviour

Distinguishing between innocent mistakes, unexpected behaviour and compromise presents another challenge.

Ayad believes organisations should not wait to establish the cause before acting.

“ Often, we cannot tell which of those we are seeing at the moment an action is requested. I would not

16 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST