Agentic AI demands a new security paradigm, writes Dr Peter Vincent, Founder and CTO, at the platform Outerlimit.
For decades, enterprise security has been built around the relatively simple assumption that if you can establish trust in an identity, you can establish trust in its actions. Employees receive training, gain permissions, and operate within defined responsibilities. Security technologies take a similar approach by authenticating the user, verifying access rights, and monitoring behaviour. While not perfect, the model has been effective because people and systems operate within relatively predictable boundaries. Agentic AI challenges that assumption.
Much discussion around securing AI agents treats them like digital employees. The language itself encourages that comparison. Agents are described as co-workers, assistants, and teammates capable of taking on routine work and increasing productivity.
The analogy is useful for explaining the technology, but it becomes less convincing when applied to security. Unlike human employees, AI agents can operate at extraordinary scale, move between domains instantly, and act with a level of speed and persistence that no individual could match. An agent may simultaneously interact with dozens of systems, process vast amounts of information, and execute complex workflows without hesitation or fatigue. Organisations are introducing highly capable autonomous actors into their environments while trying to secure them with frameworks designed for people. The resulting gap between adoption and control is substantial.
The Limits of Delegated Trust
Most enterprise security ultimately relies on delegated trust. An employee is trusted to handle customer information appropriately. A finance team member is trusted to follow approval processes. A system administrator is trusted to act within established policies. There are controls around those individuals, but organisations fundamentally assume that people understand context, exercise judgment, and recognise when an action may be inappropriate.
AI agents operate differently. Given an objective, an agent will pursue it as efficiently as possible. It does not naturally understand organisational nuance, cultural expectations, or the boundary between what is technically achievable and what is appropriate. This is not a flaw in the technology; it is a characteristic of autonomous systems.
The challenge grows as organisations rush to adopt agentic AI. In many businesses, demand is coming from every direction at once. Boards see opportunities for transformation. Business units see opportunities for efficiency. Employees increasingly experiment with AI tools to improve productivity. Security teams are therefore often asked to govern systems that have already been adopted through shadow AI. Agents will be deployed; organisations now need to retain control once they are.
Why Model Providers Cannot Solve This Problem
Companies building frontier models will continue to improve agent security, but they cannot solve it for every organisation. Model providers can make systems safer, implement safeguards, and reduce the likelihood of misuse. They cannot, however, define risk on behalf of every business. An action considered harmless by a model provider may violate internal policy at a bank. A workflow that is entirely acceptable within a software company may create regulatory issues for a healthcare provider. Acceptable behaviour in one environment may be unacceptable in another. No model provider has the context required to determine whether a specific action aligns with a company’s policies, obligations, governance requirements, or ethical standards. That responsibility remains with the enterprise.
The Missing Layer: Organisational Policy
Many current approaches remain focused on understanding what an agent is doing. Visibility is important, but control depends on whether each action complies with organisational policy. Governance processes, compliance requirements, operational procedures, security policies, and cultural expectations already define how people are expected to operate. Agents taking on similar work should be held to the same standards. Security controls must therefore evaluate actions against policy rather than rely on identity alone.
Moving Beyond Access Control
Traditional cybersecurity has focused heavily on access by defining what a user can see, which systems they can reach, and what permissions they hold. Agentic AI requires a more granular level of control. An action may be technically authorised while still being inappropriate. An agent may possess valid access to a system yet attempt to perform tasks that exceed its intended scope.
Permission to interact with a tool is not enough; each action must also be appropriate to its context. Policy therefore needs to be enforced at the point of execution. Rather than relying solely on identity, organisations need mechanisms that assess each attempted action against business rules, security requirements, and governance objectives. Organisational policies then set the boundaries for agent behaviour.
From Trusting Agents to Trusting Outcomes
Agentic AI could change how organisations operate by increasing the speed and scale of automation. Securing it will require controls designed for autonomous systems rather than people.
Enterprise AI security is unlikely to depend on creating perfectly secure agents. The complexity of modern models and the pace of innovation make that goal unrealistic. A more achievable and useful standard is to keep agent actions aligned with organisational policy. Actions that meet the relevant conditions are allowed; those that do not are blocked.
The organisations best placed to succeed with agentic AI will combine capable agents with firm controls over what those agents are allowed to do. Those controls must keep autonomous actions within the standards of the organisation the agent serves.
