"How do we keep things secure when we connect AI tools and agents to our email, our file server and our ERP?" This question is being asked more and more often in organizations where agents are moving from the pilot stage into everyday work. We covered what an agent is, in which kind of work it creates value and why projects get canceled in our article on agent projects. The focus of this article is narrower: in which systems and for which operations an agent is given authority, and how that authority is limited.
The topic is on the agenda today because of new data. Of the five actions that Gartner published on 30 September 2026 and recommended that security executives take by the end of the year, one is devoted directly to agent access. According to a survey Gartner conducted with 297 cybersecurity leaders in the second quarter of 2026, 54% of organizations either have no defined approach to limiting AI agents' access or rely on predefined human access permissions for their agents.
What does the data say?
The comment Gartner adds to this finding sums up the heart of the matter well. For an AI system to create serious cyber risk, it does not need to reach the level of artificial general intelligence; the ability to affect the organization's operations is enough. For this reason, Gartner recommends treating advanced AI deployments like a risk that comes from inside the organization (insider risk). Its advice is that multi-agent autonomous systems be managed not by how smart the model is but by which operations they are authorized to perform. Gartner also recommends securing agent workflows with "guardian agents" that narrow the blast radius of a possible error.
The World Economic Forum's Global Cybersecurity Outlook 2026, published in January 2026, points in the same direction. According to the report, the share of respondents who assess the security of AI tools rose to 64% in 2026 from 37% in 2025, which means it nearly doubled in a single year. In the same survey, 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risk over the course of 2025.
Read together, the two data points show the following picture: organizations have started to evaluate AI tools, but the question of what agents can reach once they are connected to systems has not yet matured to the same degree.
Why is agent access a different kind of problem?
A draft concept paper published in February 2026 by the National Cybersecurity Center of Excellence (NCCoE), part of the US National Institute of Standards and Technology (NIST), defines agents as systems that can decide and take action with limited human oversight, and points out that the scale and variety of the actions these systems take could multiply.
The paper proposes a project to explore how the three core principles of identity management (identification, authentication and authorization) can be applied to agents. The headline topics are these: access systems being able to tell agent identities and human identities apart, tying the delegation of authority to a specific person when an agent acts on a user's behalf, and recording agent actions under the agent's own identity. One of the open questions NIST asks is also noteworthy: for an agent whose operations cannot be fully foreseen at setup time, how is "least privilege" determined? The "reliance on predefined human access" approach that stands out in Gartner's survey passes over this question: the agent works with permissions defined for people, so no boundary specific to the agent has been drawn.
Three sources of excessive agency
OWASP's 2025 risk list for large language model applications, one of the most widely used references in application security, describes this problem under the heading "Excessive Agency". According to OWASP, the root of the problem is usually one of three factors: excessive functionality, excessive permissions and excessive autonomy.
- Excessive functionality: The tool the agent connects to also includes functions the job does not require. For example, an agent that only needs to read documents is given an extension that can also modify and delete them.
- Excessive permissions: The tool has broader authority in the underlying systems than it needs. In OWASP's example, an extension that only needs to read data connects to the database with an identity that also holds update and delete permissions.
- Excessive autonomy: High-impact operations are carried out without independent verification or approval.
OWASP's example scenario makes the risk concrete. An assistant built to summarize incoming emails also has the authority to send email because of the extension that was chosen. A maliciously crafted email can, through indirect prompt injection, steer the assistant into scanning for sensitive information and forwarding it outside. In this scenario, the problem lies as much in the agent holding an authority it never needed as in the model being "tricked".
A practical path: a checklist for agent access
The steps below are a general framework derived from the recommendations in the Gartner, NIST NCCoE and OWASP sources; each organization needs to adapt it to its own system architecture.
- Build an agent inventory. List which agents and AI tools connect to which systems, on whose behalf they work and which credentials they use.
- Give every agent its own identity. Agents should not work with shared accounts or with an employee's personal permissions. As the NIST paper recommends, the access system should be able to tell an agent from a human.
- Narrow authority to the task. As OWASP recommends, limit the number of extensions, the functions of the extensions and the underlying permissions to the minimum required. Do not give write permission to an agent that does read-only work.
- Avoid open-ended tools. Instead of broad tools such as running commands or fetching data from any address, prefer narrowly scoped tools that do only a single job.
- Limit an agent acting on a user's behalf to that user's authority. If an agent acts for a person, it must not be able to reach more than that person can, and the delegation of authority must be on record.
- Do not leave authorization decisions to the model. Under OWASP's "complete mediation" principle, whether an operation may be carried out should be decided not by the model but by the authorization of the underlying system.
- Require human approval for high-impact operations. Operations such as payments, bulk email sends and record deletion should not be carried out without approval.
- Log, monitor and rate-limit. Record agent actions under the agent's identity and watch for unusual behavior. OWASP states that while limiting the rate of operations does not prevent harm, it can reduce the damage.
Conclusion
Gartner's data shows that in more than half of organizations, agent access is either undefined or rests on human permissions. Yet the risk arises less from how advanced the model is than from what the agent can touch. For this reason, agent security begins, ahead of any new technology investment, with applying the existing discipline of identity and access management to agents as well: a separate identity, narrow authority, human approval and logging.
From Orient Global's perspective, completing the first three items of this checklist before putting a new agent into service lays the groundwork for the steps that follow.
Why logistics experience matters here. Warehouses and distribution networks already run on the kind of controls this checklist asks for. In a well-run operation, each person signs in to the warehouse management system under a personal ID, so every stock movement can be traced to someone; a visiting driver's pass opens the dock door they are delivering to, not the whole site; and large stock adjustments or write-offs need a supervisor's approval. Those habits map directly onto steps 2, 3, 7 and 8: a separate identity, authority sized to the task, human approval for high-impact operations and a record of every action. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end to end, building and leading teams of 100+ people and delivering lasting gains in operational performance through KPI-driven programs. He has also managed nationwide warehouse and transport operations at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
#interimmanagement #forwarddeployedengineering