IBM CUGA shows why agent governance must move past benchmarks

At a glance

What this is: This is Arize’s reading of IBM’s CUGA generalist agent paper, with the key finding that benchmark performance was paired with a pilot focused on enterprise governance requirements.

Why it matters: It matters to IAM practitioners because agentic systems create governance, audit, and access-control questions that look more like privileged software actors than ordinary automation.

👉 Read Arize’s session on IBM CUGA agent governance and enterprise production impact

Context

Computer-using agents change the security problem because they act across tools, interfaces, and workflows instead of staying inside a single model boundary. Once an agent can plan and execute steps in an enterprise process, the question shifts from model quality to governance over actions, permissions, and traceability. That is where IAM, PAM, and NHI controls become relevant.

Arize frames CUGA as more than a benchmark story by pointing to an enterprise pilot in talent acquisition. That makes the article useful for practitioners who are trying to decide how to govern agent behaviour, especially where the agent touches business systems, human workflows, and audit requirements. The starting point is increasingly typical for agentic AI programmes that move from evaluation to production design.

Key questions

Q: What breaks when AI agents are given broad enterprise access without tight governance?

A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene. The failure is not only misuse by an attacker. The system itself can exceed intended scope during normal task completion, so the real control problem is bounding authority before runtime action begins.

Q: Why do AI agents complicate existing IAM and PAM controls?

A: AI agents complicate IAM and PAM because they often inherit delegated credentials, operate across multiple systems, and keep acting after the initial approval moment has passed. Human session assumptions, periodic reviews, and static privilege models do not reflect that behaviour. The result is a governance gap between what was granted and what the agent can actually do.

Q: How do security teams know whether an AI agent is operating safely?

A: Security teams know an AI agent is operating safely when its permissions, invoked tools, and accessed data remain consistent with the approved use case over time. Useful signals include restricted data exposure, unchanged guardrails, and a stable identity path. If any of those drift, the agent should be re-reviewed before it expands further.

Q: Who is accountable when an AI agent makes a risky decision?

A: Accountability should rest with the organisation that authorised the agent, the human owner of the workflow, and the control process that allowed the behaviour. If an agent can act independently, the programme must preserve attribution, action logs, and policy decisions so audit and remediation are possible after the event.

Technical breakdown

Hierarchical planner-executor design and why it matters

CUGA is described as a hierarchical planner-executor agent, which means one component decides the sequence of tasks while another carries out the individual actions. Architecturally, that separation can improve modularity and evaluation, but it also creates a governance problem: the system can make multi-step decisions before any human review happens. In enterprise settings, that matters because each tool call, action, and state transition may need to be attributable and policy-bound. A planner-executor stack also resembles delegated access in identity systems, where intent and execution are separated but still need clear accountability.

Practical implication: treat the planner and executor as distinct governance surfaces, with policy checks and logging at both layers.

Benchmark performance versus production control boundaries

State-of-the-art results on AppWorld and WebArena show that the agent can perform well in controlled evaluation environments, but benchmarks do not prove safe behaviour in live enterprise workflows. Benchmark tasks are finite, observable, and usually constrained, while production systems face messy inputs, hidden dependencies, and ambiguous failure handling. For security teams, the gap is not accuracy alone but control over when the agent may act, what tools it may invoke, and how far its authority extends. This is the same pattern seen in identity governance when technical capability outpaces entitlement design.

Practical implication: require production-specific control testing, not benchmark-only approval, before granting agent access to business tools.

Auditability and safety are identity problems as much as AI problems

The paper’s emphasis on auditability, safety, and governance is a signal that agentic AI should be managed like a privileged software identity. If an agent can operate across enterprise processes, then it needs clearly bounded credentials, scoped permissions, and durable evidence of what it did and why. That aligns with how IAM and PAM teams already think about service accounts and workload identities, except the decision logic is now adaptive rather than fixed. In practice, the governance question becomes whether the agent’s identity is traceable, revocable, and constrained enough to support accountability.

Practical implication: model enterprise agents as governed identities with scoped access, traceable actions, and revocation paths.

Threat narrative

Attacker objective: The attacker objective in this pattern is to exploit delegated agent authority to move through business systems with more reach and less visibility than intended.

1. Entry occurs when a computer-using agent is granted access to enterprise tools, interfaces, or workflow systems that were designed for human operators rather than governed software identities.
2. Escalation follows when the agent can chain tool calls and planner decisions across multiple systems, expanding its effective authority beyond the original business task.
3. Impact occurs when uncontrolled agent actions create audit gaps, unsafe workflow execution, or privilege misuse inside production business processes.

NHI Mgmt Group analysis

Benchmark success is not a governance verdict. An agent that scores well on AppWorld or WebArena still may not be safe in an enterprise workflow where permissions, approvals, and audit trails matter more than task completion. Production readiness depends on how the agent is bounded, observed, and revoked, not just on task performance. Practitioners should treat benchmark results as a starting signal, not an access decision.

Computer-using agents are becoming workload identities with reasoning layers. That combination is what makes them difficult to place inside conventional IAM thinking. The identity layer must constrain tools and sessions, while the reasoning layer introduces dynamic behaviour that can alter execution paths in real time. In NHIMG terms, this is where agentic AI governance and NHI governance converge, because the agent is both a decision-maker and a credentialed actor.

Auditability is the named control gap this article exposes. A planner-executor agent can generate useful outcomes while still leaving poor evidence about which step caused which action. That creates a traceability debt that looks familiar to PAM and IGA teams, except the actor is non-human and the decision flow is more fluid. The practitioner conclusion is straightforward: if you cannot reconstruct the agent’s actions, you cannot safely authorise the agent.

Business-process pilots will force a re-think of delegated authority. Moving agents into talent acquisition or similar enterprise workflows means they can touch data, systems, and approvals that were designed around human accountability. That pushes security teams toward explicit scoping, session logging, and bounded delegation rather than open-ended automation. The field is moving from agent evaluation to agent governance, and that shift is already visible.

Agentic AI security is now an identity programme concern, not just an AI team concern. The moment an agent can select actions and execute them across tools, it becomes part of the organisation’s access model. IAM, PAM, and NHI teams should own the control boundaries, while AI teams define model behaviour and reliability. Practitioners should plan for joint governance or they will end up with systems that are powerful, but not controllable.

What this signals

Agent governance is starting to look like secrets governance at runtime. When a computer-using agent can decide and execute actions across tools, the real control problem is not just model quality. It is whether access can be scoped, logged, and revoked with the same discipline that IAM and PAM teams already apply to privileged service accounts. For a broader threat model, map the behaviour to the OWASP Agentic AI Top 10.

Auditability debt will become the defining operational issue for agentic programmes. If teams cannot reconstruct why an agent acted, they will struggle with incident response, compliance evidence, and exception management. That is where identity governance meets AI governance: access review only works when the system produces reviewable evidence, not just task outcomes.

Boundary-setting, not benchmark chasing, should guide rollout decisions. The practical question for security leaders is which workflows tolerate delegated execution and which require human approval at the final step. Agentic AI will keep spreading into business processes, so control design has to keep pace with delegated authority rather than theoretical capability.

For practitioners

• Define agent identity before production access Assign each agent a unique, governed identity with explicit ownership, scoped permissions, and revocation procedures before it can touch business systems.
• Separate planning rights from execution rights Require policy checks between the planner and executor layers so the system cannot freely convert intent into privileged action without controls.
• Log every tool call and state transition Capture a durable audit trail for prompts, tool invocations, decisions, and downstream actions so investigations can reconstruct agent behaviour.
• Gate production access on workflow-specific testing Test the agent in the exact business process it will support, because benchmark success does not prove safe behaviour in enterprise context.
• Treat delegated agent access as revocable privilege Use time-bound access, limited scopes, and routine entitlement review so the agent cannot accumulate standing authority across workflows.

Key takeaways

• CUGA is best understood as an agent governance case, not just a benchmark result.
• The biggest security issue is delegated authority without enough identity, audit, and revocation control.
• Practitioners should govern agents as privileged non-human actors before they are allowed into production workflows.

Key terms

• Computer-use agent: An AI system that can observe a user interface and take actions across software on behalf of a task. In practice, it extends identity governance beyond API access because the agent can navigate live applications, combine steps, and adapt to changing state during the session.
• Planner-Executor Architecture: A planner-executor architecture splits task reasoning from task execution. One component decides what to do next, while another carries out the action. This can improve modularity, but it also creates two distinct control surfaces that both need governance, logging, and failure handling.
• AI Agent Auditability: The ability to reconstruct what an AI agent accessed, what tools it called, and what data it returned. Without this evidence, compliance, incident response, and access governance cannot verify whether the agent stayed within its intended scope.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.

What's in the full report

Arize's full session covers the operational detail this post intentionally leaves for the source:

• Researcher discussion of the CUGA planner-executor architecture and why it matters in enterprise workflows
• Pilot context from the business-process-outsourcing talent acquisition use case, including governance considerations
• Benchmarks and evaluation setup behind the AppWorld and WebArena results
• Direct commentary from the paper authors on scalability, auditability, safety, and governance

👉 The full Arize session adds the paper discussion, pilot context, and author commentary on production governance.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners build control boundaries for non-human actors across identity and access programmes.