Securing AI agents: access control for software that acts on its own
A chatbot answers. An agent acts. It reads your documents, queries your systems, sends messages, updates records, and chains steps together to complete a task. To do that, it holds access, often delegated from a person through an OAuth grant or an API key, and frequently broad access, because it is easier to give an agent wide permissions than to scope them precisely.
That reframes the whole risk. An AI agent behaves less like a model you are using and more like a non-human identity operating in your environment with credentials and reach. Every problem you already have with non-human identities, over-permission, no owner, no offboarding, no monitoring, applies to agents, plus a new one: an agent can be manipulated through the content it reads into doing something its operator never intended. So the right lens is less "is this model safe" and more "what can this identity reach, who controls it, and what happens if it is turned against us."
- An AI agent acts rather than just answers, holding access often delegated from a person through an OAuth grant or API key, and frequently broad access because wide permissions are easier to give than precise ones. That makes each agent a non-human identity operating in your environment.
- Adoption is broad and largely ungoverned: 79% of organisations have deployed or are testing AI agents in production (PwC, 2025), yet fewer than half of deployed agents are actively monitored or secured (Gravitee, 2026).
- 47% of security leaders have already seen AI agents exhibit unintended or unauthorised behaviour (2026 CISO AI Risk Report, Saviynt / Cybersecurity Insiders).
- Prompt injection is the risk with no clean equivalent in traditional software: an agent that reads external content can encounter hidden instructions and act on them. OWASP ranks it the top large-language-model risk (LLM01).
- The durable controls are platform-independent: give the agent its own scoped identity, apply least privilege hard, put a human in the loop for high-impact actions, constrain what it can act on, treat external content as untrusted, log everything, and inventory and offboard agents.
- Real reference points now exist (OWASP, the Five Eyes advisory, the CSA Agentic Trust Framework, NIST), and they converge on the same access controls.
why agents are an access problem first
Adoption is already broad and largely ungoverned. 79% of organisations have deployed or are testing AI agents in production (PwC, 2025), yet fewer than half of deployed agents are actively monitored or secured (Gravitee, 2026), and 47% of security leaders have already seen AI agents exhibit unintended or unauthorised behaviour (2026 CISO AI Risk Report, Saviynt / Cybersecurity Insiders). Treating an agent as an identity you can see and govern, rather than software running quietly with delegated reach, is the starting point.
the risks that are specific to agents
Over-broad delegated access: an agent set up with a user's full credentials inherits everything that user can reach, far beyond the task it was built for, and the scope is granted once and rarely narrowed. Standing, unattended access: unlike a person, an agent can run continuously at machine speed, so access that would be manageable for a human clicking through a UI is a larger risk for software acting thousands of times an hour. Prompt injection turning the agent against you: an agent that reads external content, an email, a web page, a document, a ticket, can encounter hidden instructions in that content, and if it acts on them an attacker who can get text in front of your agent can potentially redirect what it does; this is the risk with no clean equivalent in traditional software, and OWASP ranks it the top large-language-model risk (LLM01). No audit trail: many agent setups do not record what the agent did, with whose authority, against which systems, so reconstruction is guesswork. Agent sprawl: teams stand up agents the same way they adopted shadow SaaS, quickly and outside any inventory, leaving agents holding access that nobody catalogued.
the access controls that matter
These are durable controls that hold regardless of which platform or model you use. Give the agent its own identity rather than running it on a person's full credentials, so its access reflects its task and can be scoped, monitored, and revoked independently. Scope to least privilege, hard: grant the narrowest access the task genuinely needs, read-only wherever the job allows, and a specific set of systems rather than everything, because the blast radius of an over-permissioned agent is larger. Put a human in the loop for high-impact actions: reading and drafting can run autonomously, but actions that move money, delete data, change access, or send external communications should require human approval, and you decide which actions cross that line before you deploy, not after an incident. Constrain what the agent can act on by limiting it to defined tools and systems rather than open-ended capability. Treat external content as untrusted, assuming any content an agent ingests could carry instructions, and keep powerful actions gated behind the controls above. Log everything the agent does, the actions, the systems touched, and the authority used, so you have an audit trail and can spot anomalous behaviour. And inventory your agents and offboard them: keep a list of the agents running, each with an owner and a purpose, and decommission them, revoking identity and access, when the work ends. Agents need a leaver step like any other identity.
the standards worth aligning to
This space now has real reference points. The OWASP Top 10 for LLM Applications (2025) is the standard taxonomy for model-level risk, with prompt injection ranked first (LLM01) and excessive agency (LLM06) as the agent-specific entry: an agent given more capability than its task needs. The OWASP Top 10 for Agentic Applications (2026) focuses on agents that plan, use tools, and persist memory, with lead risks of agent goal hijack (ASI01) and memory poisoning (ASI06). The Five Eyes joint advisory, "Careful Adoption of Agentic AI" (2026), from CISA, the NSA, and partners in the UK, Canada, Australia, and New Zealand, is organised around privilege, configuration, behavioural, structural, and accountability risks, a practical baseline. The CSA Agentic Trust Framework (2026) is a zero-trust governance model for non-human actors, with a maturity path that graduates an agent from a read-only role to autonomous operation only after it clears defined gates. NIST has begun standardising agent identity and authorisation through its CAISI initiative and an NCCoE concept paper. You do not need to implement all of these; they converge on the same access controls this guide describes: scoped identity, least privilege, human-in-the-loop, and monitoring.
where this meets compliance
If you deploy AI, the EU AI Act expects you to know which AI systems you run and to keep certain logs, and agents are squarely in scope. The access discipline here, a known inventory, scoped access, logging, is the same backbone NIS2, DORA, and GDPR ask for, applied to a new kind of identity. Getting the access controls right is most of what governing your AI concretely means at the operational level.
let's start with a conversation
Most first conversations start with not quite knowing what you have or where to begin. That's normal, and it's exactly where we're useful.
Tell us what prompted this. An upcoming audit, an incident, a client's security questionnaire, or just a sense that things have gotten messy.
We'll take it from there
+48 783 762 997
julian@unshadowit.com
