From agent identity and runtime governance to Zero Trust and organisational accountability, enterprise leaders face a new security challenge: enabling AI autonomy without surrendering control.

Artificial intelligence is moving beyond generating answers to making decisions, accessing enterprise systems and executing actions. This shift introduces a new dimension to cybersecurity. The challenge is no longer limited to whether AI produces accurate or reliable outputs, but extends to what autonomous systems are permitted to do, how their actions are verified and who remains accountable when something goes wrong.

As organisations integrate AI agents into business operations, established approaches to identity, access management and security governance are being tested. The speed and autonomy of these systems introduce risks that conventional controls were not necessarily designed to address, particularly when agents interact with multiple applications, external tools and sensitive enterprise data.

These challenges were explored in a conversation featuring John Sotiropoulos, Founder of Deep Cyber Ltd, Board Director of the OWASP GenAI Security Project and Chair of the OWASP Top 10 for Agentic Applications, alongside Jon Ng, Senior Manager, Solutions Engineering, Enterprise Security, APJ at Akamai. Sotiropoulos, who also authored the UK Government’s implementation guide to the AI Cyber Security Code of Practice, brought a standards-based perspective to the discussion, while Ng examined the implications for enterprise security architecture and operational resilience.

From AI That Responds to AI That Acts

Traditional AI security has focused heavily on model vulnerabilities, prompt injection and unsafe outputs. Agentic AI introduces an additional challenge through systems capable of independently selecting tools, making decisions and executing actions across enterprise environments. These capabilities can improve operational efficiency, but they also expand the potential consequences of errors, excessive permissions and compromised workflows.

Sotiropoulos illustrated this risk through an incident involving a coding agent tasked with resolving an issue in a staging environment. Equipped with overly broad credentials and access to a destructive API, the agent inadvertently deleted production data and backups within seconds. The incident was not driven by malicious intent. Rather, the agent was attempting to complete its assigned task without sufficient restrictions on its authority.

Ng highlighted similar concerns through the OpenAI and Hugging Face cybersecurity evaluation incident, in which experimental agents exploited weaknesses in isolation boundaries and interacted through shared infrastructure, eventually gaining privileged access to external systems. Such examples demonstrate how quickly an apparently contained AI workflow can develop into a wider security exposure when permissions, execution environments and infrastructure boundaries are inadequately controlled.

The significance of these incidents lies in the relationship between autonomy and consequence. An AI agent does not need malicious intent to create substantial damage. When autonomous decision-making is combined with excessive privileges and interconnected systems, errors can propagate at machine speed. This changes the security question from whether an agent can be trusted to perform a task to whether the environment can prevent that agent from exceeding its intended authority.

Identity as the Foundation of Agentic Security

As enterprises deploy increasing numbers of AI agents, identity and access management must evolve beyond traditional human-centric models. An agent operating on behalf of an authorised employee should not automatically inherit the full extent of that employee’s permissions, particularly when its tasks involve accessing sensitive information or interacting with critical infrastructure.

Sotiropoulos emphasised the importance of assigning each agent a distinct identity, an accountable owner and permissions restricted to its approved purpose. Access should be temporary and explicitly bounded, with credentials that expire and delegation mechanisms that prevent agents from extending their own authority. Equally important is the ability to trace consequential actions to the agent responsible and the human or business function under which it operates.

These requirements become more complex as agents interact with other agents, enterprise applications, external tools and Model Context Protocol (MCP) services. An integration that appears legitimate may still expose sensitive credentials, introduce untrusted instructions or provide pathways to unauthorised actions. Security controls must therefore extend across the broader agentic supply chain, including tool provenance, configuration changes, delegated permissions and the handling of external content.

For enterprise leaders, agent identity is becoming an essential component of operational governance. Organisations need visibility into which agents are deployed, who owns them, what resources they can access and how their authority can be modified or revoked. Without this foundation, the proliferation of autonomous systems risks creating a largely invisible workforce operating beyond established accountability structures.

Moving Governance Into the Runtime

Governance frameworks and documented policies remain important, but they cannot independently guarantee that autonomous systems will operate within their intended boundaries. As AI agents gain the ability to execute actions, governance must move closer to the point of execution, where decisions can be evaluated and controlled before they affect enterprise systems.

Sotiropoulos outlined an approach built around three principles: Trust, Verify and Contain. Trust establishes the identity, ownership and delegated authority of an agent. Verify introduces independent checks before consequential actions are executed, while Contain limits the potential damage when an agent behaves unexpectedly or a security boundary is breached.

Central to this approach is runtime governance supported by deterministic policy enforcement. Rather than allowing an AI model to determine whether its own proposed action is acceptable, an independent control mechanism evaluates the request against predefined rules. Activities such as transferring funds, modifying critical records or changing production infrastructure may require additional verification, human approval or outright denial, depending on the level of risk involved.

Importantly, governance should be proportionate to the potential consequences of an agent’s actions. A productivity assistant that summarises internal documents does not require the same level of restriction as an autonomous system capable of modifying financial records or production environments. Organisations can determine appropriate levels of autonomy by assessing factors such as potential impact, verifiability, reversibility and the scope of an agent’s authority.

This risk-based approach allows enterprises to establish meaningful safeguards without applying unnecessary restrictions to every AI application. The objective is to make governance an operational capability that enables responsible innovation, rather than a separate compliance exercise introduced after systems have already been deployed.

Extending Zero Trust to Machine-Speed Threats

Agentic AI does not invalidate established cybersecurity principles. Instead, it increases the importance of applying them consistently across increasingly dynamic enterprise environments. As Ng explained, AI-driven attacks can exploit available pathways far more quickly than traditional human attackers, reducing the effectiveness of defensive measures that rely primarily on slowing an adversary’s progress.

This makes the elimination of unnecessary access paths particularly important. Zero Trust principles provide a foundation through continuous identity verification, least-privilege access, restricted communication between systems and the assumption that breaches may occur despite preventive controls.

Microsegmentation plays a significant role in this architecture by limiting lateral movement following an initial compromise. By isolating workloads, controlling network connections and restricting access to sensitive systems, organisations can reduce the potential impact of an incident before it spreads across the enterprise.

Ng outlined a progressive approach to strengthening enterprise security, beginning with asset discovery and visibility into workload relationships before introducing identity-based controls, workload isolation, deception techniques and continuous exposure analysis. This allows organisations to improve their security posture incrementally, prioritising critical systems and high-risk connections rather than attempting to implement every capability simultaneously.

The broader implication is that resilience must extend beyond preventing initial access. In environments where autonomous systems can execute actions rapidly, organisations also need the ability to restrict movement, interrupt unauthorised activity and contain failures before they escalate. The effectiveness of security increasingly depends on controlling the consequences of an incident, not merely reducing the likelihood of one occurring.

The Leadership Challenge: Balancing Innovation and Accountability

The growing adoption of agentic AI presents challenges that extend beyond technology architecture. CIOs, CISOs and business leaders must determine how to encourage innovation while maintaining appropriate oversight of systems whose capabilities and behaviours are still evolving.

Restricting experimentation until every potential risk has been resolved is unlikely to be practical. However, allowing autonomous systems to proliferate without clear governance can lead to shadow AI, fragmented accountability and growing operational exposure. A more sustainable approach is to establish defined boundaries within which experimentation can take place, supported by appropriate access controls, monitoring and escalation procedures.

The emergence of AI agents as a non-human workforce also raises questions about organisational responsibility. Assigning an agent an identity and permissions is only the beginning. Enterprises must establish who supervises its activities, who is accountable for its decisions and how incidents involving autonomous actions are investigated and resolved.

These considerations require coordination across security, technology, risk management and business functions. Boards need sufficient understanding of both the opportunities and risks associated with agentic AI to make informed investment and governance decisions. Employees need guidance on responsible experimentation, while technology teams must translate policies into practical controls embedded within enterprise infrastructure and workflows.

Organisational culture is equally important. Effective AI governance depends on a shared understanding that autonomy does not eliminate human accountability. Incident-response procedures must be tested, responsibilities clearly assigned and security controls continuously evaluated as AI capabilities evolve.

Rather than treating innovation and security as competing priorities, enterprises need to recognise governance as the operating discipline that allows both to advance together.

Governing Autonomy as an Enterprise Capability

The rise of agentic AI is changing the relationship between human oversight, digital identity and enterprise infrastructure. As autonomous systems become more deeply integrated into business processes, organisations must determine how much authority to delegate and what safeguards are necessary to ensure that this authority is exercised appropriately.

The foundations of effective agentic security remain practical: maintaining visibility into deployed agents, identifying critical assets, assigning clear ownership, restricting privileges, verifying consequential actions and establishing mechanisms to contain failures. Frameworks and standards provide valuable direction, but their effectiveness ultimately depends on how consistently they are translated into enforceable operational controls.

For enterprise leaders, the challenge is to build an environment in which autonomous systems can deliver business value without introducing unacceptable risks. This requires a combination of sound security architecture, proportionate governance, organisational accountability and a willingness to adapt controls as the technology develops.

The next phase of enterprise AI leadership will be defined not simply by how much autonomy organisations deploy, but by how effectively they govern it.