The "least privilege" security principle is insufficient for AI agents because they can be social-engineered to misuse their technical permissions. Governance requires "measured autonomy," a form of semantic containment that restricts what an agent *should* do, not just what it *can* do, to shrink its potential blast radius.
Similar to "Shadow IT," employees are using powerful, unmanaged AI agent tools without corporate oversight. These "shadow agents" can gain the same system access as a powerful employee but without any identity, limits, or oversight, creating a significant and often invisible risk for CISOs and CTOs.
The defining characteristic and primary risk of an AI agent is not its chat-like interface but its capacity to take autonomous actions within business systems. Governance must focus on this execution boundary, where prompts, memory, and tools converge to create potential enterprise harm.
Traditional audit logs and screenshots are inadequate for AI agents. To ensure accountability, every agent needs a distinct, machine-readable identity, like a Decentralized Identifier (DID). All agent actions should be cryptographically signed and recorded in a tamper-evident ledger to create a trustworthy audit trail.
Instead of a binary human-in-the-loop decision, enterprises should use an "autonomy budget" for agents. Actions are classified by risk (e.g., irreversibility, financial impact) to determine the level of freedom, creating a spectrum from full autonomy to required human approval, avoiding agents becoming expensive suggestion boxes.
Governing individual agents in isolation is insufficient. When multiple agents interact, organizations must implement fleet-level policies that oversee their interactions and handoffs. This approach is critical for preventing emergent risks, like violating segregation of duties, which can occur even when each agent is performing its individual task correctly.