The Fallacy of Treating Autonomous Agents Like Employees
Sixty-nine percent of enterprise organizations are running autonomous AI agents on shared credentials. That isn't just sloppy engineering; it's an active invitation for structural security failure. Recent research published by VentureBeat highlighted how credential sharing directly correlates with higher rates of security incidents and near-misses. But fixing non-human identity is only the bare baseline.
At VB Transform 2026, Mukesh Karki, CTO of NTT DATA AIVista, and Mayank Upadhyay, Chief Security and Trust Officer at Snowflake, laid out a stark reality: identity controls alone will never stop an exploratory system from breaking enterprise boundaries.
The industry loves comparing AI agents to digital employees. That metaphor is broken. When you hire a human worker, you conduct background checks, evaluate context, and build trust over years. You can't perform background checks on ten thousand software agents launched in an afternoon. As Karki pointed out, even a top-performing employee in one organization struggles when dropped into a new environment without local context. AI agents face the exact same barrier, but at machine speed and scale.
Upadhyay offered a far more realistic framing: treat autonomous agents like interns. They come with high intent and zero institutional experience. They don't always understand the secondary consequences of their actions. You don't hand an intern the keys to the kingdom on day one; you watch them closely, enforce strict boundaries, and expand their scope only as they demonstrate reliable execution.
Why Static Credentials Cause Forensic and Operational Collapses
Traditional application security relies on deterministic assumptions. A human user clicks a button in a web client, and the application executes a predictable API call over a pre-defined path. Security teams build access rules around that deterministic behavior.
Agentic systems discard that model entirely. An AI agent operates with what Upadhyay described as a brain of its own. It constantly rewires its reasoning loop, selecting new tools, querying different endpoints, and trying alternative paths to complete a goal. If you hand an exploratory agent excessive permissions or a static API key, it will explore right up to the maximum boundaries of that credential.
Static credential sharing creates two distinct failure modes:
- Unintended side effects: Giving an agent a broad credential gives it the combined union of every user's access requirements. Because agents experiment, they will eventually invoke API endpoints that developers never intended them to reach.
- Forensic attribution failure: When an agent misbehaves or alters critical production data using a shared API key, your security logging cannot pinpoint which specific agent or session initiated the change.
If your incident response team cannot isolate which autonomous loop triggered a database write, your audit log is functionally useless.
Dynamic Action-Based Authorization Over Scoped Credentials
For organizations operating in regulated sectors like healthcare, finance, and insurance, scoped credentials are table stakes. An agent without scoped credentials shouldn't even make it past staging. But Karki emphasized that static scoping is still insufficient because real-world compliance depends on real-time context.
Consider an insurance claims adjustment agent. The rules governing a claim in Washington State differ drastically from regulations in California. Furthermore, individual corporate policy rules layer on top of state mandates. A credential that permits an agent to adjust claims generally doesn't guarantee that a specific action is legal or policy-compliant at the exact moment of execution.
That is why enterprise governance must move from static identity checks to real-time, action-level authorization. Authorization logic must evaluate every single tool call against two layered constraints:
- Jurisdictional boundaries: The legal framework governing the specific geographic and regulatory region of the transaction.
- Organizational rules: Internal risk limits, policy thresholds, and workflow constraints.
Karki noted that provability is an enterprise's actual license to operate in regulated markets. You have to prove to external auditors in a tamper-resistant manner that the system enforced policy at the moment of action. If you try to retrofit audit logging onto an existing agentic architecture, you will fail. Provability must be architected from day one.
The Three-Layer Architecture for Agent Governance
To prevent agentic drift while maintaining operational velocity, Upadhyay outlined a comprehensive three-layer governance architecture:
The Agent Layer
Governance begins outside the agent itself. This layer handles identity verification, dynamic tool permissions, and Model Context Protocol (MCP) governance. Enforcing rules outside the model ensures the agent cannot bypass security logic through internal reasoning tricks. On the Snowflake platform, for instance, administrators set platform-wide guardrails—such as mandatory read-only modes—while developers narrow session-specific permissions when launching tasks.
The Model Layer
This layer neutralizes indirect prompt injection attacks and protects enterprise data privacy. Models should run inside the customer’s Virtual Private Cloud (VPC), ensuring raw prompts and sensitive context remain entirely invisible to external model providers.
The Data Layer
The foundation of agent security rests on zero-copy architecture, rigorous role-based access control (RBAC), and strict least-privilege enforcement. Agents must only interact with data elements strictly necessary for their active task context.
When high-risk actions arise, system trade-offs between autonomy and constraint can be managed dynamically. By leveraging task-level confidence scoring, platforms can automatically downgrade risky operations from full autonomy to human-in-the-loop review or isolated sandboxing.
Where Security Teams Must Start: Static Secrets and Shadow MCP
If you are auditing existing agent deployments today, where should you begin? Upadhyay recommended focusing immediate remediation on two high-impact areas:
First, eliminate static secrets embedded inside agent configurations. Hardcoded API keys represent the largest fixable attack surface in agentic deployments. Replace static keys with short-lived, task-scoped tokens.
Second, tackle shadow AI by establishing an enterprise MCP gateway. Developers frequently run bootlegged open-source MCP servers under their desks to connect models to internal tools. An MCP gateway brings those connections into the light, providing central administrators with complete visibility into which agents are communicating with which backend tools and database endpoints.
Building secure agentic systems requires moving past the illusion that identity alone is enough. Scoped credentials get your foot in the door; action-level authorization, independent guardrails, and tamper-resistant logging keep your enterprise safe.
