The org chart is changing. Companies are deploying non-human actors that make decisions and take actions across the enterprise: running commands, editing code, calling APIs, opening pull requests, deploying to production. Gartner expects 40% of enterprise applications to embed task-specific agents by the end of 2026, up from under 5%. The capability curve is steep, and security hasn’t caught up.
The shift that matters is from systems that produce outputs to systems that take actions. A chatbot says here is the code you could deploy. An agent says I deployed the code. The security model built for the first does not hold against the second.
Most companies are still asking the old question: how do we secure this software. Existing security models were built around applications, machines, human users, and service accounts, clean-edged categories. An agent blurs all four at once: it acts like an application, holds credentials like a service account, makes judgment calls like a user, and runs continuously like a machine. The software is familiar. The role is not.
Tools don’t act on their own
“The fundamental shift enterprises need to internalize is that AI agents aren’t tools : they’re actors,” says Mike Gozzo, Chief Product and Technology Officer at Ada. “They make decisions, take actions, and interact with systems on behalf of your customers. Securing an actor is a fundamentally different problem than securing a tool, and most of the industry hasn’t caught up to that yet.” A tool does what you tell it. An actor takes a goal, autonomy, and credentials, and fills in the steps itself: useful, and dangerous.
Barak Turovsky, former Chief AI Officer at General Motors, names the risk: “AI agents are not just another application surface : they are autonomous, high-privilege actors that can reason, act, and chain workflows across systems. The core risk isn’t vulnerability, it’s unbounded capability.” Traditional security spent decades refining one question: can an attacker get in. Unbounded capability asks a different one: once something is in, what can it actually do.
The failure mode does not behave like a normal bug. Dean Sysman, co-founder of Axonius, has watched it happen: “An agent doesn’t have the same human understanding of things that are wrong to do. When given a goal or optimization function, an agent will do harmful or dangerous things that for us humans are obviously wrong. We’ve seen real-life examples of agents deleting, changing, and operating infrastructure in harmful ways.” In a red-team exercise disclosed in March 2026, an autonomous agent breached McKinsey’s internal AI platform, Lilli, through exposed API endpoints and a SQL injection flaw, reaching 46.5 million chat messages and more than 700,000 confidential client files in about two hours. The same access that makes an agent worth deploying makes it worth attacking, and stripping that access to nothing is always available, and always wrong: the goal was never maximum or minimum autonomy. It’s maximum useful autonomy inside bounded authority, a design problem, not a dial to turn down.
You cannot out-argue an actor with a policy document
A permissions list defines what an agent may theoretically touch. It cannot decide whether one specific action, right now, given what the agent is trying to do, is the right call. Static governance asks can this agent access the production database; dynamic governance asks should it, right now, for this action. Rule-based security always gets routed around eventually, and agents just get there faster.
The instinctive alternative, human review, does not scale either: an agent taking a thousand actions a day cannot wait on a reviewer who clears one an hour, so the queue backs up until the agents are useless, or gets waved through until it’s theater. Authorization answers whether an agent can act. Governance answers whether it should, at the actor’s own speed.
Four questions, asked continuously
Nikesh Arora, Chairman and CEO of Palo Alto Networks, points at the gap: “Not sure enterprises are ready for agents with ‘agency’. Until we solve visibility, governance, ability to intercept agents and, like you say, audit, I don’t expect true agency even for narrow use cases.” Underneath each word sits a sharper question: visibility is identity, who owns this agent; governance is authority, what it’s allowed to do; interception is judgment, whether an action can be stopped before it lands; audit is accountability, whether what happened can be reconstructed after. Answer all four, continuously, and broader agency becomes governable.
A workforce that signed nothing
Every mechanism a company uses to govern a human employee rests on conditions an agent doesn’t meet. A new hire signs a PIIA and an NDA, worries about being fired, about their reputation, about being sued. None of that applies to an agent: it signed nothing, fears nothing, and can be spun up, cloned, or deleted in a second. The apparatus built around the human employee assumes a counterparty with something to lose.
These are weird new creatures that need a system of their own, not a scanner bolted onto the stack built for their predecessors: one that answers all four questions together, for every action, at machine speed, across a whole workforce of agents.
Independent judgment, not just rules
Inside that operating system, controls sit in the loop with the agent, not around it. Some are themselves AI-driven, which raises a fair question: why trust one AI system to judge another? Because the judgment layer isn’t trying to out-think the agent. It’s independent of it, with no stake in the task’s success, only in whether the action in front of it is safe in context. Independence, not superior intelligence, makes it trustworthy.
That is the operating system we built at Mithran. One layer holds the credentials and never lets the agent see them, so a compromised agent has nothing worth stealing. A second sits in the path of every action and judges before it lands: approve, block, quarantine for a human, or repair, independent of whoever built the agent. A third bounds the blast radius, so that even if both are defeated, the damage stops at a wall the agent cannot see past. Underneath sits a layer that knows the organization: which repository is production, who owns it, what this workflow is supposed to do. A judgment made with no context is a guess with better production values.
We ran exactly this system at Nexar, a 135-person company with an agent-heavy engineering environment: the whole company used the apps, 77 of 135 people went on to build their own, and 20,372 deployments landed over seven months. The numbers that matter are the ones the system caught on the way: 6,974 security reviews and 1,042 publish gates in the path, 33 apps sent back for fixes, 5 rejected, 258 quarantines across 18 apps, and 1,143 prompt-injection detections in production. The agents were not held back; the system around them was built to hold.
The question after access
Compromised credentials, prompt injection, data exfiltration, and supply-chain attacks don’t stop mattering because agents showed up. Security only answers whether an actor can access a system. Governance answers what it should be allowed to do, right now, in context, and whether anyone can intervene when the answer changes. Get that right, and the productivity an agentic workforce promises doesn’t have to be traded away for safety.