AI access policies lag in enforcement

A study from late September 2026, based on responses from 2,254 IT and security managers across eight countries, including France, reveals a major gap in how companies enforce their AI access policies. While nearly all enterprises claim to have written policies about what data AI tools can access, only about half check these accesses in real time, and less than one in five detected the last unauthorized access as it happened.

AI agents require different access rules

The study points out that traditional role-based access systems, which define what humans can do based on their job titles, are not enough for AI agents. Unlike humans, whose roles are defined by contracts and job descriptions, AI agents make decisions on their own about which tools to use and which actions to take. This dynamic behavior makes traditional access models, first described in 1992 by researchers at NIST, outdated and insufficient.

Four reasons roles fail for AI

The report lists four reasons why role-based access is inadequate. First, an AI agent used by multiple departments might have permissions that no single task justifies. Second, the same agent might need different rights for different tasks, such as reading a database or editing contracts. Third, the number of possible roles could grow exponentially, making management impossible. Finally, since AI agents can choose different tools, authorization must be checked at every step rather than just once at the beginning.

Real-world breach from AI tool

In April 2026, a security incident at Vercel began with a third-party AI tool. An employee had given the tool full access to their online office suite, which attackers later exploited. The tool’s publisher noted that a stolen OAuth token was enough to access the workspace, showing how long-term access can be dangerous if not closely controlled.

New approach to AI access control

The OpenID Foundation’s threat model, published in October 2026, highlights the same problem: access that continues beyond the intended use. A proposed solution is to use short-lived, signed tokens that specify what an AI agent can do, on which resources, for whom, and for how long. These tokens, which last only minutes, help prevent attacks that reuse access credentials. The IETF has already developed tools for token exchange, and a draft from September 2026 applies them to AI agents.

Regulations push for stricter access

Regulatory standards like DORA and NIS 2 require that access be limited to what is needed for legitimate tasks and that all access be logged. However, a role shared across many tasks or users may not meet these standards. Five steps are suggested to meet these requirements, including keeping track of all AI agents, assigning unique identifiers to tasks, checking authorization at each step, using tokens for delegation, and logging access at the task level.

A question for CIOs

To start addressing these issues, the report suggests asking the chief information officer a specific question: "Which AI agents currently have permanent access, who granted it, and how is it revoked?" This helps identify risks and ensure that access is not left unchecked.