Agentic AI differs from traditional support systems in that it does not merely provide recommendations but may also execute actions. It can retrieve information from multiple sources, interpret it in context, and then update systems, send messages, initiate processes, or make decisions within defined parameters. This offers significant efficiency potential. Tasks that previously required manual follow-up can be completed faster and more consistently. At the same time, the system may operate with the organization’s identity, delegated authority, and access rights. When an AI agent approves a transaction or shares information, it often does so on the basis of credentials, permissions, or workflows assigned by an employee or by the organization itself.

The agency is real. Therefore, the risk is real.

Traditional security models are built on the assumption that actions are performed by humans. One can ask questions, provide training, and hold someone accountable. One can also expect an experienced employee to pause if something appears unusual or disproportionate. An AI agent does not necessarily have the same intuitive brake as an experienced
employee. Even with strong training and well-designed guardrails, it may not reliably understand what is strategically sensitive in a broader sense. It may not always distinguish between what is technically possible and what is commercially sound. Nor does it consistently assess whether an action could damage reputation, conflict with culture, or create unintended ripple effects. In practice, such agents typically act through the credentials, permissions, and workflows delegated to them by people. That makes accountability especially important: when an agent acts, responsibility does not disappear. It remains tied to the employees, leaders, and governance structures that configured, authorized, and oversee its use.

When delegated permissions are extensive, the scope of action may also become extensive. If control mechanisms are not adapted to this new reality, the system may execute actions that are formally permitted but still create significant business risk. Data may become accessible to more people than necessary. Processes may be initiated without a holistic assessment. Accountability may become blurred if the organization has not clearly defined who is responsible when the system acts.

Microsoft’s Digital Defense Report shows that the misuse of legitimate identities and access privileges plays a central role in today’s threat landscape. When identity can also represent an autonomous agent operating on delegated authority, this challenge becomes even more complex.