What changes when AI acts
A model that answers questions is wrong in text. An agent that executes actions is wrong in production. The difference is not one of degree: it opens tickets, changes records, sends email, runs commands, and calls APIs with its own credential.
That moves the problem from content security to access security. The question stops being "what can it say" and becomes "what can it do, with which credential, over which data".
Identity is the core problem
An agent needs its own identity, with least privilege and a lifecycle. In practice, most run on a human's credential or on a service key inherited from another integration, scoped far wider than the task requires.
When that happens, three things are lost at once. The audit trail cannot separate what the agent did from what the person did. Revocation becomes all or nothing. And the blast radius of a compromise becomes the human's, not the task's.
Controls that matter
Scope per task, not per agent. An agent that summarizes tickets does not need write permission.
Human approval for irreversible actions. Deleting, transferring, publishing, and granting access are categories where confirmation is worth the friction.
Logging the reasoning behind an action, alongside its result. Without the decision chain you cannot investigate the error afterward.
And a chaining limit. An agent calling an agent multiplies reach without multiplying oversight.
The surface an agent creates
Every agent in production adds an endpoint, a key, and an integration. That is a new asset, and a new asset enters the external surface like any other, with the aggravating factor that it is usually published by a team that is not security. It is the same pattern as shadow AI, with write permission attached.