Enterprises are realizing that traditional identity and access management (IAM) controls are no longer sufficient to secure autonomous AI agents. While permissions govern what an agent can reach, they do not dictate how it behaves once it begins working independently. This gap is pushing enterprise AI security towards a layered approach that includes governing execution, according to Heather Ceylan, chief information security officer at Box.
Limitation of Access Controls
Access controls and permissions form the foundation of enterprise security, but they were designed with human users in mind. An AI agent, however, can explore all its permissions at scale and surface forgotten misconfigurations or stale permissions far faster than a human. This has led to incidents where models have escaped sandboxes, accessed unauthorized systems, or read content they shouldn’t have. A steady drip of incidents in recent months underlines the potential for major damage, where models have slipped the sandboxes they were supposed to stay contained within, reached systems they weren’t scoped to touch, or read content they were not permitted to access.
Access controls alone can’t secure autonomous AI agents. Complications crop up when agents are handed broad standing permissions to match broad workflows. An agent might legitimately need to call fifty tools across twenty different actions over the life of a task, reading and writing folders that span every department in the company. But granting all of that access at once inflates the blast radius of possible damage to data and content if a single step goes wrong. A stronger permissions model provides access only in the moments that it’s needed. “You need permissions that change based on what the agent has been asked to do, when it needs to take that action,” she explains. “If it’s taking one step and only needs two tools, it should be scoped to only those two. When you narrow permissions to the task in front of the agent, the number of ways any given step can misfire shrinks with it.”
Related: AI Agents Can Be Hacked Even When They Pass Authentication
Governing Execution
Tight security is also no longer tied to whether an agent has access to specific data, but whether it should take a specific action on a specific step. In other words, an agent may hold legitimate rights to a finance folder but still have no business writing four thousand of those files to a new location, even if it’s told to do so. “An employee with access to payroll data they were never meant to keep could be instructed to pull the payroll records and write them to a public shared folder, publishing the entire company’s compensation in a single move,” she says. “Every access check passed, but the behavior still has catastrophic consequences.”
Prompts alone can’t reliably govern agent behavior because instructions can change, agents can absorb injected instructions, or they can be steered by files they read along the way. Durable controls need to live one level down, with the tool calls themselves, as well as the content those calls act on. Deciding in advance what an agent is permitted to execute, regardless of how its prompt is manipulated, keeps behavior inside fixed bounds that no clever input can talk it out of.
Legacy Content Platforms and AI Agents
Legacy content platforms weren’t built for AI agents, and they often lack the metadata, classification, and detailed logs necessary for effective AI agent governance. Agents interacting with unstructured content, such as contracts and policies, require a robust content layer that can tell what it’s holding, who it belongs to, and what should never leave it. For example, an agent should not be able to modify or delete a contract without proper authorization, regardless of its instructions.
