AI agents need strict rules

AI agents, which are software programs designed to perform tasks autonomously, require strict governance to ensure they operate safely and securely. This includes assigning them a distinct identity, limiting their privileges, ensuring their actions can be traced, and maintaining human oversight to balance their autonomy with security and trust.

Risks shift with AI agents

The risks associated with AI agents are different from traditional content risks, such as biased data or misinformation. An error made by an AI agent can become a decision or action within an information system, turning into an execution risk that affects processes and outcomes directly.

AI agents could create significant value

According to the Capgemini Research Institute, AI agents could generate up to $450 billion in value by 2028. Additionally, 15 percent of business processes could reach partial or full autonomy within the next twelve months, highlighting the growing integration of AI into business operations.

Delegation is not privilege transfer

Delegation of tasks to AI agents should not be confused with transferring privileges. An AI agent acting on behalf of a user should not automatically inherit all the user’s rights. For example, a financial director has access to sensitive areas like treasury and reporting, but an agent handling invoice reconciliation only needs limited access.

Agents require clear mandates

An AI agent must be given a mandate based on a distinct identity, a specific mission, and defined resources. Its effective power should be limited to the intersection of its own rights, the user's rights, and the mission’s requirements, not the sum of these elements. This is especially important when multiple agents are working together.

AI governance is already in practice

Several companies, particularly in the banking sector, have already implemented secure and governed AI environments for employees. As these systems evolve to include agents that can actively participate in business processes, protecting data alone is no longer enough—governing the authority given to AI is also essential.

Non-human identities are widespread

The Cloud Security Alliance estimates that non-human identities, such as service accounts and API keys used by AI agents, are already 45 times more numerous than human identities in companies on average. This highlights the need for precise tracking of who—or what—is acting within a system.

End-to-end traceability is essential

Companies must be able to trace an agent's actions, its interactions with the information system, and the data sources it uses. This visibility allows for the detection of non-compliant behaviors, triggering alerts or safeguards, and maintaining human validation for critical functions until they are sufficiently tested.

Trust through governance

The goal of these governance measures is not to limit AI autonomy but to create conditions for trust. The more a company can identify its agents, limit their mandates, track their actions, and maintain human oversight, the more it can delegate important responsibilities to them.

Focus shifts to power architecture

The debate on AI security has traditionally focused on models, their data, and biases. However, with the rise of AI agents that execute actions, the focus must now shift to the architecture of power within information systems. The future will depend not only on the AI a company uses but also on who it has given control over its systems and under what conditions.