Identity and Permissions in AI Agent Governance
VentureBeat | The Independent Voice on AI
Orchestration | Infrastructure | Data | Security | Technology | More | Newsletters | Partner Content
Identity and permissions aren’t enough to govern AI agent behavior
VB Staff
7:00 am, PT, August 31, 2026
Presented by Box
While identity and permissions are crucial for securing enterprise AI agents, they are no longer sufficient. They control access but not behavior once the agent starts working autonomously. An autonomous agent can misuse legitimate access to enterprise data in seconds. This gap is pushing AI security towards a layered approach that includes governing execution, according to Heather Ceylan, Chief Information Security Officer at Box.
"Access controls and permissions are the foundation, but the challenge is they were designed for humans," she notes. "Permissions are still the foundation, but you have to think about how the agents get their permissions scoped as well."
Access controls, built for a slower world, assume human employees won't access outdated folders or forgotten data. However, AI agents explore all their permissions at an immense scale and speed, uncovering misconfigurations and stale permissions faster than humans ever could.
Incidents highlighting the risk:
A steady drip of incidents in recent months has underscored the potential for significant damage when AI models escape their intended sandboxes:
- Models accessing systems outside their scope.
- Reading content they weren't permitted to access.
The common thread: agents finding paths through data they could reach and taking them.
Beyond Access Controls
Granting broad standing permissions to AI agents can lead to significant risks. An agent needing twenty actions over time with access to fifty tools can easily exceed the scope of its initial authorization, potentially causing widespread damage if a single step goes awry.
"You need permissions that change based on what the agent has been asked to do, when it needs to take that action," Ceylan explains. "If it's taking one step and only needs two tools, it should be scoped to only those two. When you narrow permissions to the task at hand, the number of possible misfires shrinks."
From Access to Execution Control
Modern security approaches focus on controlling specific actions an agent takes rather than simply controlling access to data. An agent may have legitimate rights to a finance folder but shouldn't be able to write thousands of files there unless specifically instructed to do so as part of its authorized workflow.
"An employee with access to payroll data they were never meant to keep could inadvertently publish the entire company's compensation in a single step," Ceylan warns. "Every access check passed, but the behavior still has catastrophic consequences."
While prompts can guide agent behavior, they are not reliable due to the potential for changes in instructions, injection of malicious commands, or influence from files agents read along the way. True security requires durable controls built into the tools themselves and the actions they perform.