A recent IBM study has cast light on a growing unease in corporate boardrooms. Surveying 2,000 C-level technology executives, the research found that only 11 percent felt fully prepared for the deployment of AI agents expected over the following year. Two-thirds of CIOs and CTOs said they were accountable for AI systems they did not fully control, and 70 percent reported that teams were deploying technology faster than IT could track. These figures paint a picture of an enterprise environment where innovation is running ahead of governance, creating what IBM describes as a growing control gap.
The Rise of AI Agents in the Enterprise
AI agents are no longer hypothetical tools. They are increasingly being used to automate workflows, analyze data, and interact with business systems. Unlike traditional software, these agents can make decisions and execute actions with minimal human intervention. They are designed to achieve goals by breaking them down into subtasks, using tools, and adapting to changing circumstances. This autonomy is valuable, but it also introduces new risks. When an agent is given access to production databases, customer information, or financial systems, the potential for damage extends far beyond a simple chatbot error.
The rapid adoption of these systems has caught many organizations off guard. IT departments are struggling to keep up with the pace of deployment, and security teams are often left with incomplete visibility. The IBM survey highlights this tension: most technology executives acknowledge their responsibility for AI systems, yet a significant majority admit they lack full control. This is a dangerous combination, as it means that decisions critical to business operations may be made by systems that are not fully understood or monitored.
Capability Versus Authority
For Madhuri Chandoor, the founder of PromptHalo, an AI security and trust infrastructure company, the root of the problem lies in a fundamental confusion between capability and authority. Just because an AI agent is technically able to perform an action does not mean it should be allowed to do so without appropriate checks. Chandoor believes that organizations must clearly define not only what their AI systems can do, but also under what conditions those actions are permitted.
PromptHalo's approach is to inspect why a particular action is being performed, rather than simply what is being performed. This extra layer of context helps organizations determine whether an action aligns with user intent, assigned permissions, and the surrounding circumstances before the system proceeds. By understanding the reasoning behind an action, businesses can better identify when something is out of bounds.
The Danger of Narrow Focus
Chandoor illustrates the risk with a hypothetical database task. An AI agent responsible for managing infrastructure might be asked to improve application performance. In response, it could add or remove an index, or even change table structures autonomously in a production environment. On its face, this might seem like a reasonable technical decision. However, the action could affect live transactions, customer data, or dependent processes that were outside the agent's immediate analysis. As Chandoor puts it, "A technical conclusion can appear reasonable within a narrow focus. The context, the situation, and the downstream impact still need to be considered before an action proceeds."
This example underscores a core challenge: AI agents often operate with limited scope, optimizing for a specific metric without fully understanding the broader ecosystem. In a production environment, even a seemingly small change can cascade into significant problems. This is why context is so important. It is not enough for an agent to determine that an action is technically sound; it must also ensure that the action is safe within the larger system.
The Limits of Per-Action Checks
A particularly compelling illustration of this issue involves refunds. Chandoor describes a scenario in which an AI agent is authorized to issue refunds up to $50 without human review. A user then requests ten $50 refunds instead of one $500 refund, which would require human approval. Examined individually, each transaction appears legitimate. But when viewed as a sequence, the pattern suggests an attempt to circumvent the threshold. This is exactly the kind of behavior that traditional per-action controls fail to catch.
To address this, Chandoor argues that organizations need to review broader session context and behavior. Instead of asking only whether a single action is permissible, they should ask whether the pattern of actions makes sense. This approach is modeled on financial fraud monitoring, where institutions look at transaction patterns across accounts and time periods to identify suspicious activity. The same logic applies to AI agents: by analyzing the sequence and context of actions, organizations can spot attempts to bypass controls.
Behavioral Profiling for AI Agents
Drawing on two decades of experience in financial services, Chandoor advocates the development of behavioral profiles for autonomous agents. These profiles would exist alongside traditional identity and access permissions. Under her proposed model, teams would routinely review the resources an agent accesses, its use of tools, changes in its activity over time, and actions that appear inconsistent with its assigned role or the circumstances of a session.
This is a significant shift from current practice. Many organizations rely primarily on static permissions, granting agents access to systems based on predefined roles. But this ignores the dynamic nature of agent behavior. An agent may behave perfectly normally for weeks, then suddenly begin taking actions that are out of character, perhaps due to a manipulated prompt or a software bug. Behavioral profiling would help detect these anomalies early, allowing security teams to intervene before significant damage occurs.
Documentation and Observability Gates
Chandoor emphasizes that questions about authorization should be considered during both design and operation. In her view, teams benefit from documenting the resources an agent may access, the conditions that apply to that access, and the possible downstream effects of particular actions. This documentation serves as a baseline for evaluating whether an agent's behavior is within bounds.
In addition, she recommends implementing observability gates at key points in the agent's workflow. These gates would review activity, particularly to inspect and address when requests become repeated, unusually broad, or inconsistent with the purpose originally assigned to the agent. By creating checkpoints, organizations can contain the impact of a potentially harmful action and determine what additional controls are required to secure underlying systems.
The Accountability Imperative
Ultimately, Chandoor's message is one of responsible adoption. She favors using agentic automation for analysis and workflows, but she insists that additional verification is necessary when the impact involves critical decisions and actions. "Trust, but verify," she says. "Businesses should adopt AI responsibly and verify its behavior throughout the process. Establishing clear accountability ownership across the organizations for AI applications security is essential to operationalise these guardrails."
The IBM survey suggests that most organizations are not yet ready for the wave of AI agents heading their way. The control gap is real, and it will only widen as these systems become more powerful and more common. By distinguishing capability from authority, monitoring behavior, and building robust guardrails, businesses can harness the benefits of AI while minimizing the risks. The time to act is now, before the gap between deployment and control grows even larger.