Who owns security when AI starts taking actions?
Short answer: IT protects infrastructure, but operations must define which actions are allowed, who reviews them and how mistakes get corrected. An agent that drafts has a different risk profile from one that changes orders or writes to customers.
Short answer: IT protects infrastructure, but operations must define which actions are allowed, who reviews them and how mistakes get corrected. An agent that drafts has a different risk profile from one that changes orders or writes to customers. AI security no longer fits solely in a password manual: it needs a process owner, technical limits and an incident plan.
September 2026 announcements show the problem, not a universal cure. Anthropic announced Enterprise Frontier Safeguards with customer-controlled infrastructure for storage and monitoring signals. UiPath announced updates to governance, data, connectivity and deployment intended to keep automation inside customer-defined boundaries. These are vendor announcements. A platform offering controls does not mean they are configured, available on your plan or suited to your workflow. Anthropic; UiPath.
The full context of those announcements: from AI chat to AI work: agents, September 2026.
Four controls you can understand
- Access: what may each agent read and write? Giving an administrator account to summarize tickets is like handing over the master key to open one drawer. Limit tools, data and duration of access.
- Approval: classify actions. Summaries can stay in draft; customer-visible changes, payments or deletions require review tied to the exact action. OWASP recommends explicit approval for high-impact actions and independent validation at execution. OWASP.
- Logs and alerts: record who requested what, which sources were consulted, what was approved and what happened. Protect the logs rather than creating an unnecessary second store of sensitive data.
- Emergency stop: name who can pause the workflow, revoke credentials, investigate and communicate an error. Rehearse a small failure before using it for critical tasks.
What can go wrong?
An outside email can include malicious instructions that an agent mistakes for orders. An agent can also use data an employee should not see, repeat a wrong answer at scale or execute an action no person approved. OWASP documents prompt injection, excessive autonomy and approval manipulation as risks. The answer is not a promise that failure is impossible; it is narrower permissions, tested boundaries and observation.
Divide responsibility clearly
The process owner defines an acceptable result and exceptions. IT and security implement identity, permissions, monitoring and response. The work reviewer checks quality and fixes cases. Leadership decides acceptable risk. A small company may combine roles, but it cannot leave a box empty. NIST's AI RMF gives teams a common language for governing, mapping, measuring and managing risk. NIST.
Accountability for the outcome has its own guide: who owns the work when an AI agent participates.
Do this today: write down the owner of each automated action, its maximum authority and the channel for stopping it. If no one can say who turns it off, it is not ready to act alone.
Sources
- Anthropic: Enterprise Frontier Safeguards (Sep 1, 2026).
- UiPath: Platform updates (Sep 23, 2026).
- OWASP: AI Agent Security Cheat Sheet.
- NIST: AI RMF.
Was this article helpful?