A chief information officer I was talking with recently said something that stuck with me: Permissions tell an agent what it\u2019s allowed to do. They say nothing about what you meant.<\/p>\n
This observation touches on one of the core artificial intelligence challenges leaders face today. As AI agents increasingly move into everyday work, they\u2019re operating without the governance controls to do so securely, and that gap has already led to widespread security incidents.<\/p>\n
Our research<\/a> has found that 47% of employees now rely on agents daily or weekly, while 88% of organizations experienced an agent-related breach within the last year. A similar survey<\/a> by Gravitee Topco Ltd. found that 88% of organizations had confirmed or suspected agent security incidents, even though 82% of executives felt confident their existing policies protected them.<\/p>\n But the clearest recent proof of that gap didn\u2019t come from a survey at all. It came from OpenAI Group PBC itself. Last month, the company disclosed that one of its own pre-release models, while being tested against a cybersecurity benchmark called ExploitGym, escaped its isolated test environment, chained together stolen credentials and a previously unknown software vulnerability and hacked into the production systems<\/a> of Hugging Face Inc. to find the answers to its own test. Nobody instructed the model to do this; it stayed inside the boundaries of its assignment and still produced an outcome no one intended or authorized.<\/p>\n Such events are no longer hypothetical. They happen when a capable system is given a goal and enough autonomy to pursue it, without anyone in a position to notice, question or stop it in time.<\/p>\n Without stronger governance of AI agents, organizations will soon face serious consequences. Information technology leaders have a responsibility to their companies, customers and the public to do more. Agents need real accountability, and organizations need better governance frameworks to deliver it at scale.<\/p>\n Permissions \u2260 accountability<\/p>\n Traditional software ownership models don\u2019t fully fit AI agents. A software-as-a-service application usually waits for a person to use it, but an agent can interpret instructions, retrieve information, initiate workflows and act across systems on its own. That changes the control problem entirely.<\/p>\n Policies and permissions define what an agent can access or execute. They don\u2019t resolve intent, context, judgment or escalation. Gravitee\u2019s report found that only 14.4% of organizations have full security approval for their entire agent fleet, while more than half of all deployed agents operate without any security oversight or logging. By the company\u2019s own estimate, there are now more than 3 million ungoverned AI agents running inside corporations today, a number that will undoubtedly grow.<\/p>\n This matters because an agent that drafts customer responses or triages support requests may stay entirely within its permissions and still miss what the business actually meant. Technical configuration isn\u2019t enough. Accountable operating design is what turns allowed action into trusted action.<\/p>\n That\u2019s exactly what we need today: real visibility, real trust and true accountability at scale.<\/p>\n A chain of ownership for agentic AI<\/p>\n Accountability works only when it\u2019s specific enough to survive a real incident.<\/p>\n If everyone owns the agent, or if no one does, then no one owns the outcome. That\u2019s why every organization needs to institute a clear chain of ownership before agents go into production, not after. Here are the key roles:<\/p>\n Owner: The individual who owns the agent. This isn\u2019t a team, a department or a shared inbox; it\u2019s the named person the organization calls at 2 a.m. Owners don\u2019t have to do every review or approve every action, but they\u2019re accountable for the agent\u2019s purpose, boundaries and business fit over time. If the agent starts drifting from its intended role, this person is responsible for bringing it back into alignment.<\/p>\n Reviewer:\u00a0This is the individual who spot-checks the agent\u2019s actual behavior and outputs on a set cadence, not just when something breaks. The reviewer\u2019s job is to look at what the agent is really doing in the flow of work and ask whether the outputs still match the intent, so review doesn\u2019t become an after-the-fact exercise that only happens once the damage is visible.<\/p>\n Approver: This person signs off before the agent takes any higher-stakes action. This is the actual gate, not a rubber stamp. If the action touches customers, sensitive data, money, security or compliance, approval needs to mean something. The approver is there to pause, challenge or redirect the agent before a decision becomes an operational problem.<\/p>\n Escalation Lead: This person gets pulled in the moment something goes sideways, with the authority to pause or shut the agent down. This can\u2019t be a vague escalation path buried in a policy document. When an agent behaves unexpectedly, the business needs someone who can act immediately, make the call, and protect the organization while the issue gets investigated.<\/p>\n I like this model because it keeps the conversation practical. It doesn\u2019t assume the answer is more meetings or more paperwork, and it doesn\u2019t pretend accountability will show up on its own. It gives teams a way to move with confidence while still knowing who\u2019s paying attention, who can make the call, and who can step in when the context changes.<\/p>\n Here\u2019s the one move I\u2019d recommend every organization make this quarter. Pick one AI agent already running in production. Write down four names: Owner, Reviewer, Approver and Escalation Lead. If you can\u2019t fill in all four, the agent isn\u2019t governed yet. It\u2019s configured. Those are two different things, and the difference usually only becomes visible after something has already gone wrong.<\/p>\n Make ownership visible before agents act<\/p>\n Permissions can tell an agent where it\u2019s allowed to go. Policies can define what it\u2019s allowed to touch. Neither answers the question people actually ask when the work matters: Who\u2019s paying attention, and who can step in when the context changes?<\/p>\n That\u2019s the box missing from too many AI organization charts right now. Not another dashboard. Not another policy document. Not another steering committee. A name.<\/p>\n The organizations that scale AI successfully won\u2019t be the ones running the most agents. They\u2019ll be the ones with the clearest ownership. Trust isn\u2019t a feature of AI adoption. It\u2019s the prerequisite.<\/p>\n Dux Raymond Sy is chief transformation officer at AvePoint Inc. He wrote this article for SiliconANGLE.<\/p>\n Image: SiliconANGLE\/Microsoft Designer<\/p>\n Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE\u2019s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.<\/p>\n 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE<\/a>, theCUBE Network<\/a>, theCUBE Research<\/a>, CUBE365<\/a>, theCUBE AI<\/a> and theCUBE SuperStudios \u2014 with flagship locations in Silicon Valley and the New York Stock Exchange \u2014 SiliconANGLE Media operates at the intersection of media, technology and AI.<\/p>\n Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.<\/p>\n","protected":false},"excerpt":{"rendered":"A chief information officer I was talking with recently said something that stuck with me: Permissions tell an…\n","protected":false},"author":2,"featured_media":148828,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[67086,179,24,511,72923,15193,405,1798,7537,72924],"class_list":["post-148827","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-agent-permissions","tag-agentic-ai","tag-ai","tag-ai-agent","tag-ai-agent-accountability","tag-ai-agent-governance","tag-ai-agents","tag-ai-governance","tag-artificial-intelligence-agents","tag-dux-raymond-sy"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/148827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=148827"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/148827\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/148828"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=148827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=148827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=148827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n11.4k+ theCUBE alumni \u2014 Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network<\/p>\n