An agent may retrieve the wrong invoice or generate an incorrect query while performing an authorised task. Appropriate access boundaries can limit the consequences.

However, attempts to retrieve credentials, escalate privileges or transfer sensitive information outside the organisation warrant greater scrutiny. Repeated prohibited actions may justify terminating a session.

“ We do not have to label the behaviour in real time to control it. We need to judge each significant action against the task, respond according to its risk, and retain a clear record linking the agent’ s actions to its owner and the work it was authorised to do.”

Balancing autonomy with security

Excessive restrictions could undermine the productivity benefits of autonomous AI, particularly when controls are introduced late in development.

“ Access rules should be designed into the workflow early, so the agent can do its job without each routine step becoming a negotiation,” Ayad said.

He advocates a risk-based approach that allows relatively low-risk activities, such as reading, searching, summarising and drafting, to proceed without unnecessary interruption.

Greater scrutiny should apply to actions involving sensitive information, production environments or deletion of business records. These may require additional validation or human approval.

“ Such a risk-based approach leaves the agent free to work out how to achieve its objective while giving the business control over what it can do in its systems. It also builds trust.”

The objective is to preserve autonomy within clearly defined security boundaries.

Establishing ownership and accountability

As agentic AI deployments expand, governance will increasingly involve CISOs, CIOs, AI leaders and business functions. However, Ayad believes accountability must rest with a clearly identified business owner.

“ Put simply, every agent needs one clear business owner. That person should be able to say why the agent exists, what outcome it is meant to deliver and whether it is still needed.”

The CISO must establish and test access controls, while technology and AI leaders ensure agents operate securely and their actions remain traceable. Business leaders must define expected outcomes and operational boundaries.

“ But I would be careful about letting shared governance become nobody’ s accountability. A business user can give an agent a perfectly legitimate objective, and the agent can still choose an unacceptable way of achieving it,” Ayad said.

Clear ownership is especially important when agents operate across departments or access interconnected systems.

Preparing for the autonomous enterprise

With enterprises potentially deploying hundreds or thousands of autonomous agents, Ayad believes CISOs must establish scalable governance before adoption accelerates.

The first priority is implementing controls that evaluate and enforce access decisions whenever agents attempt significant actions.

The second is visibility. Security teams need an accurate inventory of active agents, their owners, identities and accessible systems to identify unnecessarily broad permissions.

The third is operational readiness. Organisations must test whether they can distinguish agent activity from human activity, terminate sessions and reconstruct which systems or data an agent accessed.“ That needs to be exercised, not just written in a policy.”

As autonomous AI becomes embedded in enterprise operations, the CISO’ s role is expanding beyond conventional identity governance towards continuous oversight of machinedriven actions.

For Ayad, enterprises must move beyond policies and initial authentication towards controls that can evaluate, authorise and, when necessary, stop an AI agent’ s actions in real time.

These capabilities will be critical to scaling agentic AI while maintaining security, accountability and trust.

The CISO must establish and test access controls, while technology and AI leaders ensure agents operate securely and their actions remain traceable. Business leaders must define expected outcomes and operational boundaries.

WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 17