Your agents will guess. Permissions decide what that costs you.

Agentic AI, agent governance, permissions, ~5 min read

Somebody at your company has already handed an AI agent a credential. Maybe it went through review. Maybe an operations manager wanted invoice reconciliation to stop eating her Fridays, found a tool that promised it, and pasted in a service account key. The agent works. It has been working for six weeks. Nobody wrote down what it is allowed to touch, who owns it, or how you would switch it off at four o’clock on a Friday.

A piece published on BleepingComputer on 29 July puts the mechanism plainly: agents guess. They try an action, read what comes back, adapt, and try again. The article is sponsored content from an identity security vendor, so take the product pitch with the usual salt. The diagnosis holds up anyway, and it is the part worth putting in front of your own team.

Guessing is the job description

A script does the same thing every time. You can read it, test it, and know what it will do in production because it has no capacity to do anything else. An agent works differently on purpose. You give it an objective, and it decides on the path. That flexibility is why anyone wants one. It is also why you cannot write an allow-list of the actions it will take, because neither you nor the vendor knows what they will be until it takes them.

Most of the safety work being sold right now sits downstream of that. Prompt filters, content policies, behavioral monitoring: all of them inspect what the agent is trying to do after it already holds the keys to do it. The BleepingComputer piece has a good line about the arithmetic there. One percent of infinity is still infinity. An agent making thousands of decisions a week against a filter that catches almost everything will still get through, and when it does, the only thing standing between a wrong guess and a bad outcome is what that agent’s credential can reach.

So the useful question is not whether the agent will be wrong. It will be wrong. The question is how far a wrong answer travels.

The math nobody put in the budget

Palo Alto Networks surveyed 2,930 security leaders for its 2026 Identity Security Landscape report and found 109 machine identities for every human identity in the enterprise, up from 82 to 1 the year before. The same research found that 96% of respondents say their human identities already operate with access well beyond what their roles require.

Two more numbers from that report are the ones I would put on a slide. Only 37% of organizations can revoke an AI agent’s credentials. Only 30% keep immutable audit logging of what those agents did.

Sit with that for a second. A third of companies can turn an agent off. Under a third can reconstruct what it touched. Everyone else has deployed something that acts on their data, at speed, with standing access, and has no mechanism to stop it or to explain it afterward. That is not a technology gap. It is a governance gap wearing a technology costume.

Small and mid-sized organizations tend to assume this is an enterprise problem because the identity counts are enterprise counts. The ratio is the point, not the total. A 45-person company running a handful of agents across email, finance, and a shared drive has the same structural exposure as a bank, minus the identity team that would notice.

Scope the mandate, not the model

The fix is old and boring, which is why it works. Treat an agent the way you would treat the person whose work it took over.

That person had a job description. They had a manager. They had access to the systems their job required and not the ones it did not. When they left, IT closed the account, and there was a record of what they had done while they were there. None of that was exotic. It was just applied consistently, because HR and IT had a shared process that made skipping it awkward.

Applied to agents, it comes down to four things you can start this week:

• Find them. Every organization has more agents running than leadership has approved. Ask each department head what is automated and who set it up, and write the answers down. This is a conversation, not a scan.
• Give each one a named human owner and a written mandate. What is this agent for, what data does it need, what is it explicitly not permitted to do. If nobody will put their name on it, that is your answer about whether it should be running.
• Scope the credential to the mandate, and make it revocable. Standing broad access is the multiplier that turns a wrong guess into an incident. An agent that reconciles invoices does not need write access to the CRM.
• Log what it did, somewhere it cannot edit. When an auditor, a client, or your own board asks why a decision came out the way it did, “the AI did it” is not an answer that survives contact with anyone.

Notice that none of this requires you to predict the agent’s behavior. It requires you to bound it. That is the shift the BleepingComputer piece is arguing for, and it is the same shift identity teams made twenty years ago when they stopped trying to trust users and started scoping them.

Your data, your rules, and that includes the AI working on it

Your AI, your rules. That means an agent operating inside your walls, on infrastructure you control, with permissions you set and can withdraw, and a record you own of everything it did. Not a promise from a vendor that their filters are good. A boundary you can point at.

At Modular Technology Group we build agent programs this way because the alternative gets expensive in a specific, predictable direction: the day something goes wrong and nobody can say what happened. Modular’s agent work runs under a written policy from day one, with a named owner per agent, scoped and revocable access, and an audit trail that lives on the client’s own infrastructure rather than a vendor’s.

Agents are worth having. Ours run our own operations daily. But an agent is a delegation of authority, and delegation without a mandate is just hoping. Start with the list of what is already running. Most teams find it is longer than they expected, and that discovery alone is worth the afternoon.