From AI that responds to AI that acts
Until very recently, businesses used generative AI through conversation: someone asked a question and the model answered. An agent, by contrast, queries data, calls tools, chains tasks together and acts on behalf of a person or process. And when a machine acts, the question is no longer “What does it say?” but “What does it do, with what permissions, and who is accountable for it?” We see this every week in many companies: pilots arrive before policies, and agents enter the business before the tools to govern them.
Why agents amplify risk
Agents do not create entirely new risks; they amplify the risks we already had. If an organization has overexposed data, inherited permissions that no one has reviewed, or a lax information classification system, an agent will find that data, use it and expose it at a speed only a machine can achieve. This is particularly evident in three areas.
Identity. An agent operates within our systems, but it is neither a person nor a conventional service account: it decides how to use the access it has and, moreover, it can be manipulated. An email or document containing hidden instructions (prompt injection) can cause it to carry out legitimate actions for illegitimate purposes.
Permissions. The temptation is to give the agent every permission “just in case,” so it works first time. This is the pattern we encounter most often when reviewing agents before they go into production. A manipulable agent with broad access and an output channel is an open door to data leakage.
Traceability. We must be able to answer who activated the agent, which identity it acted under, what data it queried and why. Without this visibility, it is impossible to investigate an incident or demonstrate compliance with the European AI Act and the GDPR.
We must also account for the proliferation of agents in organizations from different sources: embedded in the applications we already use, created by users themselves, brought in by third parties through the back door (shadow AI), and developed in-house. When we conduct an initial inventory with a client, there are almost always more agents than the company thought it had.
We must govern agents for what they are: identities that act
The good news is that we do not have to start from scratch. The key is to treat every agent as another member of the organization: with its own identity, a human owner, access limited to what it needs, and a record of everything it does. In practice, we apply two principles also included in OWASP’s Top 10 for Agentic Applications. Minimum agency means limiting not only what an agent can access, but also how freely it can act without consulting a person. Giving an agent autonomy is an act of trust, not a way to transfer accountability. The second principle is observability: knowing what the agent does, why it does it and on whose behalf.
Modern technology for a modern risk
These principles cannot be implemented through a policy that no one reads. We need technologies designed for AI and agents, with governance built in from the design stage rather than added as an afterthought.
Identity and permissions. Every agent should have its own identity in the corporate directory, conditional access, and an assigned owner. Its permissions must be revocable immediately, and it should only be able to see what the person invoking it can see, with confidentiality labels and data loss prevention in place.
Runtime guardrails that detect prompt injection attempts and block sensitive actions or require human approval before they proceed.
A centralized control plane that inventories all agents, measures their usage, detects orphaned agents or those operating outside policy, and integrates their activity with security monitoring. In the Microsoft ecosystem, for example, Agent 365 provides this governance layer, while Entra ID, Purview and Defender address security.
Govern to accelerate, not to slow down
Governance is often seen as a brake on innovation. Our experience with clients suggests the opposite: organizations that are clear about who can create agents, which data they can use and what controls apply are the ones that scale fastest, because they do not have to go back to the drawing board every time a pilot is ready for production. The recipe is easy to state but demanding to execute: agents aligned with business processes and measurable returns, well-organized data before anything is connected, and a platform with native governance.
At Softeng, a founding partner of CIDAI, we help companies adopt AI securely as they digitalize—from identifying use cases with tangible returns to deploying agents governed by design. We maximize AI’s potential, safely.
References
OWASP GenAI Security Project, Top 10 for Agentic Applications for 2026: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
