AI agents operate inside authenticated sessions with broad permissions. The security controls that enterprises built for human users do not prevent agents from taking actions the accountable human never approved. Here is the gap and how to close it.
Every enterprise security architecture is built on a set of assumptions about who is taking actions in a system. The perimeter protects the outside. Authentication verifies who enters. Role based access control determines what they can do. Audit logs record what they did. This architecture was designed for a world where the entity taking action inside a system was a human. AI agents have invalidated that assumption without invalidating the architecture itself. The controls still run. They just no longer protect what they were designed to protect.
When an AI agent is granted access to enterprise systems, it typically operates within the authenticated context of a human user or a service account with defined permissions. The agent can do everything the permission set allows. If the human user has permission to initiate wire transfers, approve purchase orders, access patient records, or file regulatory documents, the agent operating in that context can do the same. The access controls see a valid session with valid permissions. They do not see that the action was taken by software rather than by the accountable human.
This is not a misconfiguration. It is the expected behavior of these systems. Service accounts and delegated permissions have always existed. What has changed is the scale, speed, and autonomy of the agents operating under these permissions. A human with broad permissions is still constrained by the bandwidth of human cognition. An AI agent with the same permissions can initiate hundreds of consequential actions in the time it would take a human to evaluate one.
Three specific threat categories emerge from this gap. The first is prompt injection. An adversarial instruction embedded in content the agent processes can redirect the agent to take actions within its permission scope that the accountable human never requested. A document that contains instructions to forward sensitive data, initiate a transaction, or modify a record can be processed by a well intentioned agent operating in a legitimate session. The agent follows its instructions. The access controls see a valid session. The action is logged under the human user's identity.
The second threat is scope creep in autonomous workflows. AI agents given broad mandates to accomplish complex goals make sequences of decisions about what actions to take. Each individual action may be within the agent's permissions. The sequence as a whole may represent decisions the human user would not have approved. Without action level authorization checkpoints, the human discovers the sequence only after it has executed.
The third threat is credential compromise that extends to AI operations. If an attacker obtains a session token or a service account credential, they gain the ability not only to take actions themselves but to instruct AI agents to take actions. The leverage from a single credential compromise is multiplied by the autonomy and speed of the agents operating under it.
Multi factor authentication does not help because the agent operates inside an already authenticated session. Role based access control does not help because the agent is authorized for the roles granted to the session. Rate limiting partially helps but cannot distinguish between legitimate high volume agent operations and malicious ones. Audit logging does not prevent the action; it records it afterward.
The control that is missing is action level human authorization. A requirement that a specific identified human authorize each consequential action before it executes closes the gap that all other controls leave open. An agent cannot produce a cognitive credential. A compromised session token cannot generate a valid proof. A prompt injection attack can direct the agent to request authorization, which then requires the actual enrolled human to respond. The attack hits a wall it cannot bypass.
Closing this gap requires treating consequential action authorization as a first class security control, not an audit artifact. The architecture is straightforward: define what constitutes a consequential action for your organization, instrument your AI agent workflows to pause before executing those actions, require a cognitive authorization challenge at that pause point, and require a valid signed proof before the action proceeds.
The result is a system where the audit log does not just record what happened. It contains cryptographic proof of who approved each consequential action and when. That is not just a security improvement. It is the foundation of accountability in an agentic enterprise environment.
AI agents operate inside authenticated sessions with the human user's permissions, so they can take consequential actions the accountable human never approved. Authentication, role-based access control, and audit logs all see a valid session, so none of them catch the gap.
A malicious instruction embedded in content an agent processes can redirect the agent to take actions within its existing permissions. The access controls see a legitimate session and allow it. Requiring action-level human authorization stops this, because the agent cannot produce the human's cognitive authorization.
MFA verifies the session at login, not each action. Role-based access control authorizes the role, not the specific act. Rate limiting can't tell legitimate high-volume agent work from malicious work. Audit logs record actions after the fact. The missing control is per-action human authorization.