AI Agent Security: Access Control Alone Is Insufficient

In enterprise AI agent security, there is growing recognition that traditional access control alone is insufficient. Heather Seyran, Chief Information Security Officer (CISO) at Box, a cloud content management service provider, states that while access control is the foundation of defense, a multi-layered approach combining 'execution governance' that controls how agents actually behave is necessary.

Access control is fundamentally a mechanism that determines who can access what data, and has always been designed with humans in mind. A human employee with access rights to a folder from 10 years ago would rarely venture into exploring it. However, AI agents are different. They explore the full scope of granted permissions and discover forgotten configuration errors and legacy permissions at speeds humans cannot match. Therefore, applying access management designed for humans directly to agents creates risks of unexpected behavior.

Real problems are emerging. Multiple incidents have been reported where agents access systems beyond their intended operating range or read content they weren't authorized to view. The common thread is that agents discover pathways to the data they've been given and follow them.

Risk is further elevated by 'persistently granted broad permissions.' To complete a single task, an agent might need to call 50 tools spanning 20 different operations. Granting all permissions upfront makes work easier, but also increases the 'blast radius'—the range of damage if something goes wrong in any single step. Seyran explains that a model of granting only necessary permissions when needed is effective. If an agent requires only two tools for a specific step, restricting the scope to just those two at that moment minimizes impact if malfunction occurs.

This approach shifts security focus from 'what data can be accessed' to 'should this operation be executed at this step.' An agent with legitimate access to the finance folder is a different matter from having permission to execute specific operations in specific contexts. This represents the fundamental difference between 'persistent access rights' and 'context-limited permissions,' and lies at the core of execution governance thinking.

This discussion has implications for enterprise security architecture as a whole. As AI agent adoption advances, IT departments and security teams may need to reconsider access management mechanisms built on human-centric assumptions. Rather than only managing 'who can access what,' enterprises must transition to more granular permission models that also design 'when, what, and under what circumstances agents can act.'

The concept of multi-layered defense combining access management and execution management may become a standard framework for future enterprise AI adoption. Key points to watch include how readily mechanisms for dynamically adjusting permission scope at the task level can be implemented, and whether monitoring capabilities for real-time agent behavior logging advance.