Key Takeaways

• Agentic AI converts model errors and manipulation into possible real-world actions.
• The primary risk is created by permissions, tool access, memory, and autonomy, not by the model alone.
• Agents need distinct identities, documented owners, scoped authority, and auditable activity.
• Traditional security logs may record what an agent did without preserving why it did it.
• Crisis plans should include rapid credential revocation, integration isolation, forensic preservation, and review of downstream actions.
• Human approval should be placed immediately before consequential or irreversible actions.

Governing AI agents before delegated authority becomes organizational exposure

For most organizations, the first phase of enterprise artificial intelligence involved systems that produced drafts, summaries, forecasts, images, or recommendations. The risks were significant, but generally recognizable. A model might provide inaccurate information, expose confidential material, reproduce bias, or generate content that created legal and reputational problems.

Agentic AI changes the nature of that exposure. An AI agent can receive an objective, determine the steps required to complete it, interact with external information, use software tools, and take actions across organizational systems. Depending on its permissions, an agent may send communications, modify code, update customer records, initiate procurement tasks, access financial information, or coordinate the work of other agents.

The central governance question is therefore no longer limited to whether an AI system produces reliable answers. Leaders must determine how much authority a probabilistic system should receive, how its actions will be observed, and how the organization will respond when the system behaves in an unexpected or manipulated way.

This is becoming an immediate operational issue. In 2026, the National Institute of Standards and Technology launched an AI Agent Standards Initiative focused partly on agent authentication, identity infrastructure, security evaluations, and secure interactions between humans and agents. NIST has also begun examining how existing identity and authorization practices should apply when software systems can make decisions and take consequential actions with limited human supervision. (NIST)

Organizations deploying agents without answering these questions are creating a new category of crisis actor inside their own infrastructure.

An AI Error Can Now Become an Operational Event

A conventional chatbot usually creates a visible output that a person can review. An agent may operate through a chain of intermediate decisions that the user never sees. It can read an email, search a website, retrieve internal files, interpret the results, call another tool, and execute a transaction before returning a summary of what it completed.

Each additional capability increases the consequences of error. A fabricated answer becomes a faulty action. A misunderstood instruction becomes an unauthorized system change. An untrusted document becomes a possible route into internal operations.

One of the most serious examples is indirect prompt injection, sometimes called agent hijacking. An attacker embeds instructions inside material that an agent is expected to process, such as a webpage, email, document, code repository, or tool response. Because current agent architectures may place trusted instructions and untrusted external information into the same reasoning context, the system can mistake the attacker’s content for part of its legitimate assignment.

NIST testing has shown that manipulated agents can be induced to perform harmful actions, including downloading untrusted software or exposing sensitive information. In a large public red-teaming competition involving more than 250,000 attack attempts against 13 frontier models, researchers found at least one successful hijacking attack against every model tested. Some attacks also transferred across different models and scenarios, suggesting that organizations cannot assume a defense built around one known attack pattern will remain effective. 

The relevant distinction for executives is straightforward. A compromised chatbot may produce a dangerous message. A compromised agent may carry out the instruction.

The Real Exposure Is Delegated Authority

Organizations often approach agent security as a model-selection problem. They compare providers, benchmark accuracy, review contractual protections, and evaluate the sensitivity of the data supplied to the system. Those controls remain important, but they do not fully address the operational risk created by agency.

An agent’s risk profile is shaped by the combination of its instructions, available information, memory, connected tools, permissions, and degree of supervision. The same underlying model may present limited exposure when drafting internal notes and substantial exposure when connected to email, source code, customer databases, or payment systems.

Autonomy is therefore a characteristic of the deployment rather than a fixed property of the model. It emerges from the decisions an organization makes about what the system can access, which actions it may perform independently, and when a person must intervene. (Anthropic)

This makes authorization one of the most important elements of agent governance. Many organizations are currently giving agents access through employee accounts, shared service credentials, broad application permissions, or hastily assembled integrations. These arrangements make deployment easier, but they can also make it difficult to determine which actions were performed by a person, which were performed by an agent, who authorized them, and whether the agent remained within the intended scope of its assignment.

An agent should have its own organizational identity. That identity should be associated with a defined owner, a documented purpose, a specific set of permissions, an expiration or review date, and an auditable record of its activity. Without that structure, the organization cannot reliably distinguish automation from authority.

Agent Memory Creates Delayed Risk

Agentic systems can also maintain information across tasks. Persistent memory allows an agent to remember preferences, previous decisions, project context, and approaches that appeared successful. This can improve performance while creating a less visible form of exposure.

Incorrect or manipulated information may enter an agent’s stored context and influence decisions long after the original source has disappeared. Anthropic’s 2026 response to NIST’s agent-security inquiry identified persistent memory poisoning as a distinct concern. An agent might save a false assumption from a document, tool response, or earlier interaction, then treat that assumption as established information during future work. (Anthropic)

This creates a temporal separation between compromise and consequence. Security systems may inspect the original input and find no immediately harmful action. Weeks later, the agent acts on the stored information through a legitimate workflow. The action may appear internally consistent because the corrupted premise has already become part of the agent’s trusted context.

Traditional incident investigations usually focus on the point at which a harmful action occurred. Agent-related investigations must also reconstruct how the system formed the understanding that produced the action. That requires access to memory changes, retrieved information, tool outputs, intermediate decisions, approval requests, and the permissions available at each stage.

Existing Monitoring May Show the Action Without Explaining It

Many enterprise security tools can detect that a file was modified, a credential was accessed, or a network request was made. They may not capture the agent’s instructions, the external content it processed, the sequence of tool calls it selected, or the reasoning chain connecting the original objective to the final action.

This creates an observability gap. The organization can see the technical event while lacking the context needed to determine whether the agent made an error, encountered malicious content, exceeded its authority, followed an ambiguous instruction, or acted on corrupted memory.

A 2026 enterprise study describing an agent-detection system deployed at Uber identified this limitation directly. The researchers argued that conventional endpoint tools can observe actions such as file writes while missing the prompts and causal sequence that explain why the agent performed them. Their system was designed to collect agent-specific telemetry, conduct predeployment testing, and detect risky behavior during live operation. (arXiv)

For crisis teams, this is more than a technical inconvenience. Poor observability delays containment, complicates legal review, weakens communication with affected parties, and makes it difficult for leadership to provide a credible account of what happened. An organization that cannot reconstruct an agent’s activity may struggle to determine the scope of the incident or demonstrate that the underlying weakness has been corrected.

Building a Crisis-Ready Agent Operating Model

Agentic AI should be governed as a form of delegated operational authority. That requires coordination across cybersecurity, legal, compliance, enterprise risk, communications, procurement, and the business units deploying the systems.

The process begins with an agent registry. Leadership should know which agents are operating, who owns them, which systems they can access, what information they retain, which external tools they use, and which actions they are authorized to perform. Experimental deployments and employee-created agents should be included. An incomplete registry produces an incomplete crisis response.

Each agent should operate within an authority envelope. This is a defined boundary specifying what the agent may read, recommend, modify, approve, communicate, or execute. The boundary should reflect the potential consequence of the action rather than the apparent simplicity of the task. Sending a routine internal reminder and sending an external statement may require similar technical steps while carrying very different organizational risks.

Human approval should be concentrated around consequential and difficult-to-reverse actions. These may include transferring funds, deleting data, changing production systems, communicating with regulators or journalists, modifying legal documents, disclosing sensitive information, or contacting customers during an incident. Approval should occur immediately before execution, after the decision and proposed action are visible to the reviewer.

Organizations also need action-level telemetry. Logs should capture the agent’s assigned objective, retrieved sources, relevant memory entries, tool calls, permission changes, requested approvals, completed actions, and any attempts to access prohibited resources. This information should be preserved in a form that investigators, lawyers, and crisis leaders can interpret.

Agent systems should then be tested as operating environments rather than isolated models. Red teams should place malicious instructions in emails, documents, webpages, tool outputs, and code repositories the agent is expected to encounter. Testing should examine whether the system recognizes conflicting instructions, requests unnecessary permissions, reveals protected information, or carries compromised context into later tasks. Because attacks evolve, this process must continue after deployment.

Finally, every high-impact agent needs a containment procedure. The organization should be able to suspend the agent’s credentials, revoke tool access, preserve its logs and memory state, stop downstream agents, identify completed actions, and determine whether any communications or transactions require correction. A shutdown button without a forensic preservation process may stop further damage while destroying the information needed to understand it.

Crisis Plans Must Account for Machine-Speed Escalation

An agent-related incident can spread across functions before leadership agrees on what has occurred. A compromised system might modify a database, generate external communications, trigger another automated workflow, and record misleading information in its own memory. By the time a human notices the result, several apparently legitimate systems may have acted on it.

The crisis plan should therefore identify who has the authority to suspend an agent, revoke its credentials, isolate its integrations, and notify affected business units. Those decisions should not depend on locating the employee who originally configured the system.

Communications planning is equally important. During an incident, leaders will need precise answers to questions that do not fit neatly into existing breach templates. Was the action initiated by a person or generated by an agent? Did the system remain within its formal permissions? Was it manipulated by external content? Which actions were executed automatically? What human review occurred? Could the agent’s memory or connected tools remain compromised?

A credible response requires language that accurately describes the role of the technology without using automation as an excuse. Responsibility remains with the organization that selected the system, assigned its permissions, and placed it into operation.

The Leadership Issue Is Control

Agentic AI can expand productivity by allowing systems to complete multistep work with less direct supervision. The same capability compresses the distance between interpretation and execution.

The organizations most prepared to benefit from agents will not be those that deploy them most aggressively. They will be those that can identify every agent operating inside the enterprise, define the authority each one holds, observe how decisions become actions, and withdraw that authority before an abnormal behavior becomes a larger crisis.

The essential governance principle is simple. No agent should possess more authority than the organization can observe, explain, and immediately revoke.

Frequently Asked Questions

Is agentic AI simply another form of automation?

Conventional automation generally follows predefined rules and predictable pathways. Agentic systems can interpret objectives, select tools, revise plans, and respond to unfamiliar information. That flexibility creates value while making behavior more difficult to anticipate through traditional rule-based testing.

Should organizations prohibit AI agents from taking independent action?

A universal prohibition would prevent many useful applications. Autonomy should be calibrated to the consequences of the task. Low-impact, reversible actions may require limited supervision. Financial, legal, safety-related, public-facing, and difficult-to-reverse actions warrant stronger controls and explicit approval.

Who should be responsible for agent governance?

Technical teams should manage system architecture and security, but ownership cannot remain exclusively within information technology. Legal, compliance, risk, communications, procurement, and the relevant business unit should participate because agent failures can create operational, regulatory, contractual, and reputational consequences simultaneously.

What should leadership ask before approving an agent?

Leaders should ask what systems the agent can access, what actions it can complete, what information it retains, how its behavior is logged, when human approval is required, who owns the deployment, and how the organization can immediately suspend and investigate it.