The Shift From Analysis To Action

Traditional AI lived in the background, analyzing data, surfacing insights and supporting human decisions. Agentic AI steps into the foreground with the ability to recommend and execute actions autonomously. This has effectively expanded both workforce capabilities and risk.

To add to that, adoption is accelerating quickly. A 2025 McKinsey study found that 62% of respondents said their organizations are at least experimenting with AI agents, with 23% scaling them in their enterprise.

In lower-risk environments, this may look like efficiency gains or automation at scale. In critical industries, it raises more urgent questions. The moment AI moves from passive assistant to active participant, the rules change. The question is no longer “What can AI do?” but “What should AI be allowed to do—and under whose authority?”

Working Through The Discomfort

In conversations with customers, partners and even my own team, I keep hearing the same pattern: People recognize that AI is becoming an integral part of how work gets done, but many are uneasy about what that means. They see its potential to reduce burden and help teams operate at scale. At the same time, they’re wrestling with harder questions around authority, oversight and trust.

That discomfort is rational. We know how to trust people because we understand the frameworks around them. AI doesn’t fit neatly into those same mental models. It can influence decisions, initiate workflows and operate with increasing autonomy, but without the human context we instinctively rely on.

This is the uncomfortable reality: AI is advancing faster than our traditional models of governance and accountability are adapting to it. Still, resisting or avoiding the technology adoption wave is not a viable strategy.

The answer is not denial. It’s discipline. We must become comfortable with the uncomfortable by being clearer about authority, accountability, identity and control.

AI Agents And Expanding Risk: The New Insecurity Layer

Every AI agent introduced to the environment brings a new identity, new permissions and new opportunities for misuse or error, especially when adoption outpaces governance. This creates a new layer of insecurity. The risks are familiar in one sense, but amplified in another: over-provisioned access, credential sprawl, weak attribution, privilege escalation and automation operating at a speed and scale that can magnify mistakes. In some industries, that may mean operational disruption or data exposure. In critical sectors, it can impact safety, continuity and trust.

To address this, businesses must first stop treating AI agents like background automation and start treating them like identities that need to be governed with intention.

The Role Of Identity And Ownership

The first practical step is straightforward: Every AI agent should have its own unique, verifiable identity. No shared accounts. No invisible automation. No hardcoded credentials passed across systems.

That identity should live inside existing identity and access management (IAM) and security frameworks, not outside them. It should be authenticated through approved enterprise controls, linked to a defined purpose and tied to a human owner responsible for its use, oversight and review.

Once an agent is uniquely identified and clearly owned, it becomes much easier to answer the core questions of accountability, such as: What is this agent supposed to do? Where is it allowed to operate? Under whose authority? That clarity is foundational to trust.

Setting Clear Boundaries Around Authority

Operational control follows identity. AI agents should not receive broad access simply because they are useful. They should receive only the access required for a specific task, system or workflow.

Carrying this out involves enforcing least-privilege dynamically and limiting access by time, role, application, context or action type. For higher-risk workflows, organizations should require additional approvals or explicit human oversight before an agent can proceed. Just-in-time access models are especially important here because they reduce standing privilege and make it easier to contain error.

The goal is to define the boundaries of what the agent can do.

Building Confidence Through Visibility And Governance

Agentic identity management must extend beyond provisioning. Organizations need visibility into what agents are actually doing, not just what they were permitted to do.

That means logging agent activity with clear attribution, distinguishing machine actions from human actions and monitoring for unusual behavior, unexpected access patterns or actions outside normal workflow context. It also means governing the full life cycle—from approval before deployment and regular access reviews, to ongoing adjustments and decommissioning when the agent is no longer needed.

This is how enterprises get comfortable with the uncomfortable. Not by waiting for uncertainty to pass, but by establishing identity, accountability and control around a form of technology that is becoming more capable. In this era of change, confidence will come from managing AI agents with the same rigor we expect from any human.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?