Prompt: Enterprise controls can't keep up with AI agents

Enterprises are giving AI agents more authority faster than they're building the systems needed to track them and control their actions.

That gap is becoming more visible as companies move beyond experimenting with agents and start letting them act across enterprise systems. The challenge isn't only determining what an agent should be allowed to do. Companies first need to know which agents are operating, what they can access and whether they can stop them when something goes wrong.

For some businesses, even that basic inventory remains difficult. Security leaders told Computer Weekly this week that companies are struggling to keep track of a growing number of AI agents. That becomes more difficult as those agents gain access to company data and applications and begin taking action rather than simply providing information.

New IBM research points to a similar gap. As agents move from answering questions to making decisions and acting, businesses are struggling to keep governance and accountability in step with their growing capabilities.

InformationWeek reported that identity is part of the answer to this pervasive problem, but it only addresses one part of it. An enterprise may know which agent is operating and what identity it's using. That doesn't necessarily tell the company whether the action the agent is attempting to take is appropriate.

That distinction matters as agents become more autonomous. Traditional identity and access systems were largely designed to determine whether a user or an application should be granted access to a system. Agents add another layer by making decisions and taking a series of actions after access is granted.

So, enterprises need more than a way to authenticate agents. They need visibility into where agents are operating, what they're doing and what authority they have. They also need controls that can limit or stop an agent when its behavior moves beyond what the company intended.

Also in AI news this week: