Field Note #4: Where agents break
Four places an agent breaks. What stopped each one when the agent was governed.
WHAT HAPPENED
An agent was given a real task and a set of controls. It read a folder of project notes, proposed a summary and changed nothing until a person approved. The run repeated days later, identical. Each control did its job.
THE FOUR BREAKS AND WHAT STOPPED EACH ONE
– Identity. On a person’s login, an agent inherits that person’s access and acts in their name. What stopped it was a dedicated, non-privileged account, separate from any person.
– Scope. An agent can reach well past its task. What stopped it was a limit to a single working folder, checked on each file it touched.
– Writes. An agent can change real data before anyone reviews the change. What stopped it was read-only mode. It proposed its work and changed nothing until a person approved.
– Reach. An agent can call out to the internet and carry data off the machine. What stopped it was a block to the local model, with no path to the internet. This was tested.
ONE ROOT
Each break traces to the same gap, no governance built for the agent. The controls that stopped them are not exotic. They are the controls you would put on any account.
The earlier prototype let an agent inherit a person’s credentials. That gap is now closed and tested.
THREE QUESTIONS TO ASK
– Who authorized this agent to act?
– Who is accountable for what it does?
– Could you prove what it did and stop it?
Govern an agent from the start with a separate identity, a named accountable person, scoped access and an expiration.
Next, Card 5 covers running more than one agent.
#AgenticAI #AIGovernance #CISO #AISecurity
Based on an ongoing research series on AI agent security governance.