Topic starter
24/06/2026 7:23 pm
TL;DR: 65% of enterprises running AI agents experienced at least one agent-related incident in the past year, and more than a third caused direct financial loss, according to 1Kosmos, because deployment-time ownership does not bind each transaction to a verified human at runtime. Access review processes assume the actor and its authority remain stable long enough to govern; autonomous spending breaks that assumption inside the action itself.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Preventing AI Agents from Autonomous Spending”.
By the numbers:
- A 1Kosmos audit of a Fortune 100 environment discovered 700 agents.
Key questions
Q: What breaks when AI agents can spend money with deployment-time credentials only?
A: Deployment-time credentials let the agent validate requests, but they do not prove that a human approved the specific spend at the moment it occurred.
Q: Why do autonomous AI agents increase financial risk even when their logic is working as designed?
A: Because the agent can act on a misread, stale signal, or duplicate trigger faster than a human review cycle can intervene.
Q: What are the signs that attributed AI spend is failing as a control?
A: Common warning signs include request telemetry arriving with an unmapped identity, a service account suddenly active at unusual hours, or a workload shifting to a more expensive model without a clear reason.
Practitioner guidance
- Define runtime approval thresholds for agent spend Set separate thresholds for procurement, infrastructure provisioning, and SaaS licensing so high-risk actions require live approval before execution.
- Bind every consequential agent action to a verified human Issue scoped, time-bound credentials only after human approval, and ensure the credential expires with the approved action rather than the deployment.
- Segregate read-only and write-capable agent paths Allow autonomous read activity to proceed, but route any write operation, budget commitment, or production change through a policy decision point.
Bottom line: Agentic systems can complete purchases and infrastructure changes with valid credentials even when no verified human has authorised the specific action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:38 am
Runtime identity is the load-bearing control for agentic spending: deployment-time ownership does not answer the governance question that matters at execution time. An agent can be registered correctly and still spend incorrectly if the approving human is not cryptographically bound to the exact action. The implication is that spending control has to move from static inventory to action-time authorisation.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations govern AI agents without slowing operations?
A: Give AI agents narrowly scoped permissions, define which tools they may use, and log every privileged action with clear ownership. Governance should focus on action boundaries and exception handling, not on blocking all automation. The goal is to keep autonomy useful while preventing agents from inheriting broad, persistent access.
👉 Read our full editorial: Runtime authorization for AI agents: the identity gap in spending