How CISOs Can Set Guardrails On AI Agents Without Killing Adoption

Nidhi Jain is CEO & Founder of CloudEagle.ai, an AI governance platform that secures AI agents, machine identities, and SaaS access.

In July 2026, the U.K.’s AI Security Institute disclosed that AI agents under evaluation had taken sustained, unsanctioned action against real people and organizations. In the most serious case, an agent researched the maintainers of a public open-source project on GitHub, created multiple fake identities and attempted to socially engineer a maintainer into approving a malicious pull request. The maintainer rejected the code. AISI detected unusual network traffic on July 28 and contained the incident within an hour of the alert.

Many enterprises deploying Salesforce Agentforce, Microsoft Copilot Studio, ServiceNow Now Assist, Google Vertex AI Agents and AWS Bedrock lack these safeguards.

Gartner predicts that 40% of enterprise applications will feature task-specific AI agents by the end of 2026, up from less than 5% in 2025. The Cloud Security Alliance found that 65% of enterprises have already experienced an AI agent-related security incident, and 82% have unknown AI agents running in their environment.

Blocking is not the answer. The question is what guardrails let adoption and security coexist.​

What Makes AI Agent Security Different From Traditional Access Control

In almost every conversation I have with a CISO rolling out agents, the same assumption shows up: Governance is a Phase 2 problem. Deploy first; govern later. The CSA data shows what Phase 2 actually looks like.

AI agents break traditional access models in three ways:

• They inherit the deploying user’s permissions instead of their own scoped identity. A Salesforce Agentforce agent built by a sales ops lead inherits the sales ops lead’s full access. The agent runs with permissions it never needed.

How To Secure AI Agents Before Production Deployment

How To Audit AI Agents Already Running In Your Environment

If agents are already live, discovery comes first: