The Reality of Guessing at Scale
When you watch an autonomous AI agent tackle a complex, long-running task, you are seeing the future of enterprise software. It might spend four minutes attempting a script to list files when it expected a CSV, hit an error, pivot, rethink, and finally succeed. It works, but it never follows the neat, predictable flowchart you sketched in your head.
That is "guessing at scale," and it is not a bug. It is a fundamental property of Large Language Models (LLMs). Agents operate probabilistically, making the next best decision based on an observation and feedback loop. That improvisational ability is exactly what makes them powerful for business automation, but it is also why security models designed for static workflows are failing across the enterprise. Traditional security relies on predictability; agents rely on exploration. When you pair that exploration with broad, unchecked access, every unexpected detour becomes a security vulnerability—a pattern clearly demonstrated during recent autonomous agent breaches.
The Collision of Improvisation and Static Security
For decades, we secured the enterprise by defining the perimeter and managing access to it. We built rigid identity and access management (IAM) policies meant for human employees who operate within predictable working hours, interact with a limited set of applications, and are regularly reviewed.
AI agents are the inverse. They don't sleep, they act without MFA, and they are rarely retired. They are spun up in minutes, often outside of any formal review process. As Palo Alto Networks has pointed out, the ratio of non-human identities to human identities is exploding, with AI agents being the primary driver. If your security boundary relies on static IAM policies designed for humans, you are already behind the curve.
Most organizations attempt to plug this gap with guardrails—prompt filtering, input sanitation, or behavioral monitors. These are necessary, but they operate at the wrong layer. Guardrails attempt to constrain behavior after access has been granted. Once an agent has the credentials to hit a production database or modify cloud infrastructure, the primary security boundary has already been bypassed. Filtering what an agent says is trivial if you haven’t secured what an agent is allowed to do.
The Permissions Trap
Why do these agents consistently over-permission themselves? Because least privilege is difficult to implement, and security teams are overwhelmed. It is the path of least resistance to grant an agent broad, "admin-level" access and move on to the next fire. This default configuration transforms shadow AI into a massive attack surface. As startups build new runtime architectures to enforce least-privilege authorization at runtime, security teams are finding ways to contain execution risks without blocking productivity.
When you grant an agent broad permissions, you aren't just giving it the tools to do its job. You are giving it the tools to do everything it might need, plus the tools to accidentally damage systems it should never touch. Because the agent improvises, you cannot predict the exact sequence of tool calls it will make. If those tools are sensitive, the "blast radius" of a probabilistic mistake is enterprise-wide.
Towards Intent-Based Security
If traditional IAM is insufficient for agents, what is the alternative? The answer lies in reframing security around intent.
Traditional access control asks: "What can this identity reach?" Intent-based security asks: "What should this agent be able to reach to accomplish its specific purpose, and nothing more?"
This is the only version of least privilege that survives contact with reality. You cannot manually hand-tune access controls for every session an agent runs. But you can define the purpose of an agent—"This agent is authorized to analyze daily sales logs"—and then scope permissions exclusively to that domain.
When you enforce boundaries based on intent, anything the agent attempts to do outside that scope—even if it is just a "wrong turn" in its reasoning loop—becomes an immediate security signal. It stops being a gray-area anomaly and becomes a clear violation of intent.
Operationalizing with Frameworks
Securing this new reality doesn't mean reinventing the wheel. Frameworks like the NIST AI Risk Management Framework (AI RMF) and the OWASP GenAI Security Project provide the structure enterprises urgently need.
The NIST AI RMF provides a consensus-driven structure to manage risks associated with AI, emphasizing that trustworthiness must be designed into the system, not added as an afterthought. It shifts the focus from simple compliance to a broader, risk-based posture that acknowledges the autonomous nature of these systems.
Similarly, the OWASP GenAI Security Project (building upon their work with the Top 10 for LLM Applications) documents actionable vulnerabilities directly resulting from agent autonomy. Specifically, risks like "Excessive Agency" (LLM08) and "Insecure Plugin Design" (LLM07) highlight exactly what happens when autonomy is left unchecked or plugins are granted overly broad permissions. These are not theoretical risks; they are the inevitable outcomes of deploying agents without properly constraining their operational boundaries.
Identity: The Last True Control Plane
Strip away the LLM, the prompt engineering, and the hype. One thing remains constant in enterprise security: every action an agent takes, whether it is modifying cloud infrastructure or reading confidential logs, authenticates through an identity. An API key, an OAuth token, a service account—all these are the real-world control points where actions are actually authorized.
Identity is the only layer that spans the entire infrastructure an agent touches, making it the unavoidable control plane for agentic AI.
We need to stop spending all our security budget on prompt filtering and start investing in identity-centric governance. We must treat agent identities with the same, if not greater, rigor than our most privileged human users. The goal is to make intent-based security operational—not just for the occasional audit, but as a real-time, automated constraint on agent behavior. The scale of agent deployment is accelerating. It is time the security model caught up.
Sources:
- https://www.bleepingcomputer.com/news/security/your-ai-agents-are-guessing-at-scale-permissions-decide-the-damage/
- https://www.nist.gov/itl/ai-risk-management-framework
- https://owasp.org/www-project-top-10-for-large-language-model-applications/
