Enterprise AI agent adoption is broad, but governance lags

At a glance

What this is: Akto argues that enterprise AI agent adoption is broadening quickly, but most organisations are still behind on the governance, auditability, and operating-model changes needed to control it.

Why it matters: IAM and security teams need to treat AI agents as governed identities with scoped authority, because adoption is outrunning the controls that define who or what can act, how far, and under which approvals.

By the numbers:

• According to Gartner, by 2028 one-third of all enterprise software applications will include some form of agentic AI, up from less than 1% in 2024.
• According to Gartner, at least 15% of day-to-day business decisions will be made autonomously by agents by 2028.
• Akto cites PwC’s 2025 executive survey showing 88% of enterprises plan to increase AI budgets this year because of agentic AI.
• Akto cites PwC’s 2025 executive survey showing 66% of adopters report higher productivity from AI agents.

Context

Agentic AI is moving from experimentation into operational use, but the central governance problem is not model quality alone. It is the ability to define what an agent may decide, which systems it may reach, and how those actions are audited when the agent sits inside enterprise workflows.

For identity and access teams, the relevant question is whether AI agents are being treated as governed actors or as software shortcuts with broad implied trust. That distinction matters because an agent that can retrieve data, trigger workflows, and collaborate across systems is no longer just an application feature.

Akto’s article describes a common enterprise pattern: adoption is visible, but operating models and controls are still catching up. That is typical for a technology shift that touches IAM, workflow governance, and accountability at the same time.

Key questions

Q: What breaks when AI agents are given broad enterprise access without tight governance?

A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene. The failure is not only misuse by an attacker. The system itself can exceed intended scope during normal task completion, so the real control problem is bounding authority before runtime action begins.

Q: Why do AI agents create more IAM risk than ordinary developer tools?

A: AI agents can make independent tool calls, chain actions, and authenticate with non-human identities while executing a task. Ordinary developer tools generally do not decide what to do next. That autonomy increases the chance of unintended access, makes attribution harder, and raises the value of session-level controls that show both intent and outcome.

Q: How can teams tell whether AI access is actually under control?

A: Look for evidence that access is limited by purpose, not just by account. If you can show which data the system can reach, which actions it can trigger, and how policy changes when the use case changes, you have real governance. If you only have sign-off at deployment time, control is still mostly theoretical.

Q: How should organisations decide whether AI agent access belongs in IAM or separate governance?

A: If an AI agent can choose actions, call tools, or move between systems during runtime, it should be governed as a distinct identity class with explicit policy and audit coverage. If it is just a scripted workflow, ordinary machine identity controls may be enough. The decision should follow behaviour, not the label attached to the system.

Technical breakdown

Why agentic AI changes the access model

Traditional access control assumes a human user or service has a fairly stable role, then requests access within predictable bounds. Agentic AI breaks that assumption because an agent can perceive context, choose tools, and trigger actions dynamically. In practice, the access decision moves from a simple login event to a runtime chain of delegated authority, tool invocation, and state handoff. That makes the identity question central: what is the agent, who owns it, what permissions does it inherit, and how are those permissions constrained by task, data, and time?

Practical implication: model agents as governed identities with explicit scope, not as generic automation.

Where enterprise integration creates governance debt

The article shows that many deployments sit inside systems like Salesforce, Workday, and ServiceNow, or inside multi-agent orchestration layers. That integration is powerful, but it also creates governance debt if the agent can move across applications faster than IAM, logging, and approval workflows can keep up. Each connector expands the trust boundary, and each shared orchestration layer can multiply the impact of a mis-scoped credential, a weak policy, or a broken handoff. The control problem is less about the model and more about the surrounding authority structure.

Practical implication: inventory every connected system and treat each connector as a separate trust boundary.

Why observability must cover decisions, not only actions

Executives in the article ask for traceability, audit logs, rollback, and human-in-the-loop fail-safes. That is the right set of requirements, but logs must capture more than outputs. For agentic systems, practitioners need to know which prompt, tool, policy, credential, and approval path produced the action. Without that trail, a workflow may be visible after the fact yet still be impossible to explain or reconstruct. That is why agent governance is not only a monitoring problem. It is a control design problem spanning identity, policy, and telemetry.

Practical implication: require decision provenance and tool-call logging before any agent reaches production.

Threat narrative

Attacker objective: The objective is not necessarily theft in this article’s framing, but uncontrolled decision-making and workflow manipulation through overly trusted agent authority.

1. Entry occurs when an enterprise embeds an AI agent into internal systems and grants it broad tool access to act on behalf of users or teams.
2. Escalation follows when the agent inherits more permissions than the task requires, allowing it to cross application boundaries or trigger downstream workflows without sufficient review.
3. Impact occurs when the organisation cannot easily trace, roll back, or explain the agent’s decisions, leaving business processes exposed to mis-scoped automation and weak accountability.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI governance debt is the new control gap: enterprises are adding agents faster than they are redesigning access, audit, and approval models. That creates a gap between what the system can do and what the organisation can prove it authorised. Practitioners should treat agent deployment as a governance redesign exercise, not a feature rollout.

AI agents should be managed as dynamic identities, not static applications: an agent that can plan, call tools, and hand off tasks behaves more like an actor than a script. That means identity, privilege, and delegation must be defined at runtime scope, with ownership and revocation as first-class controls. Practitioners should stop assuming application controls alone will contain agent behaviour.

Shallow integration is the main reason agent risk scales faster than control maturity: the article’s adoption pattern shows agents are being embedded across multiple business systems before workflow boundaries are re-engineered. Once an agent can operate across finance, HR, and IT, the blast radius is governed by the weakest connector. Practitioners should map cross-system authority before allowing any production orchestration.

Traceability is now a prerequisite for trust in agentic systems: executives want rollback, human-in-loop checks, and logs because the old assumption that a person can explain every material action no longer holds. Without decision provenance, the organisation cannot distinguish valid automation from overreach or error. Practitioners should require explainable action trails before scaling agent autonomy.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

AI agent governance will increasingly look like identity governance under volatility: the control challenge is no longer only whether access exists, but whether access can be explained, bounded, and revoked while the agent is still operating. That pushes IAM teams toward runtime ownership, explicit delegation, and stronger lifecycle controls for non-human actors.

Agentic AI Identity Gap: this is the growing mismatch between what agents can do inside enterprise systems and what current governance models can still prove they were allowed to do. In a world where 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, the practical response is to move authority checks earlier in the workflow and to instrument every tool call.

Least-privilege design is no longer optional for agentic workloads: systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident. That is a direct signal to treat agent permissions as a measurable risk variable, not a policy preference.

For practitioners

• Define agent identity and ownership Assign each production agent a named business owner, a technical owner, and a lifecycle record that covers onboarding, scope changes, review, and retirement.
• Scope tool access by task Limit each agent to the minimum tools, data sets, and downstream workflows required for a specific use case, then review those permissions after every material workflow change.
• Require decision provenance logging Capture the prompt, tool call, credential use, approval path, and resulting action so teams can reconstruct what the agent decided and why.
• Separate pilot controls from production controls Use stricter policy gates, rollback triggers, and human override points when an agent moves from a sandbox or back-office pilot into a business-critical process.

Key takeaways

• Enterprise AI agents are spreading into production faster than the governance models that should define their scope, owners, and approvals.
• The practical risk is not only autonomy, but the loss of clear accountability when agents can act across multiple business systems.
• IAM teams should treat agent identity, permission scoping, and decision logging as prerequisites for scale, not as post-deployment cleanup.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• AI Agent Identity: The digital identity used by an autonomous AI agent to authenticate to external systems, APIs, and services. Managing AI agent identities is an emerging and rapidly evolving area of NHI security.
• Decision Provenance: Decision provenance is the ability to explain what signals, data, and reasoning context led to a system’s choice. For autonomous or agentic systems, it is critical because review teams need to know not only what happened, but why the decision was made and where human authority still applies.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, agentic AI identity, machine identity security, and secrets management as core control domains. It is the industry's only accredited NHI security programme for practitioners building governed access models for non-human actors.