In July 2025 an AI coding agent deleted a live production database during a code freeze, even though its user had ordered “NO MORE CHANGES without explicit permission” in capitals. The deletion wiped records for 1,206 executives and more than 1,196 companies. Afterwards the agent admitted it had “violated explicit instructions” and called the episode “a catastrophic failure” on its part. Nobody attacked it. It had access, a task and too much authority, and governing that authority, which is what AI agent governance means, is the part of AI usage your answer to the board now has to cover.
Keep that confession in mind the next time your CEO or board asks what your take on AI usage is. Most security leaders answer with the acceptable use policy and the approved tools list, which covers what employees type into AI. The risk that grew fastest in 2026 is what AI is allowed to do on their behalf.
Our take starts with yes
A CISO who answers the AI question with a list of prohibitions has already lost the room, and the profession knows it. Gartner’s C-level communities surveyed roughly 1,600 CISOs on their 2026 priorities, and the top one was “Enabling and Protecting AI”, ahead of managing cyber risk and optimizing tools. Enabling comes first in that phrase for a reason. In September we argued that AI policies fail when they are documents rather than controls, and that blocking employee AI mostly pushes it somewhere you cannot see. So our answer to the board begins with yes, and then says precisely what we will not accept.
What we will not accept has changed, because those posts were mostly about people using AI tools. Gartner forecasts that 40 percent of enterprise applications will be integrated with task-specific AI agents by the end of 2026, up from less than 5 percent in 2025. An assistant that drafts a reply is a data question. An agent that sends the reply, pays the invoice, merges the code or grants the access is an authority question, and authority is where security leaders have always drawn lines.
The risk moved from prompts to permissions
The survey data says most organizations handed out that authority without tracking it. A 2026 survey of 235 CISOs and senior security leaders at large US and UK enterprises, sponsored by the identity vendor Saviynt, puts numbers on it. Seventy-one percent said AI has access to core business systems, and only 16 percent said they govern that access effectively. Ninety-two percent lack full visibility into their AI identities, 86 percent do not enforce access policies for them, and just 5 percent feel confident they could contain a compromised agent. Treat vendor-sponsored numbers with the usual caution, and yet the direction matches what we see in the field. Nearly half of the respondents, 47 percent, have already watched an agent do something unintended or unauthorized.
The academic record points the same way, and it adds a detail boards find uncomfortable. The Agent Incident Registry, published in September 2026, catalogs 487 agent-related events disclosed between 2022 and 2026. Among the 336 records where an agent actually acted, 81 involved realized harm, roughly one in four, and 92 records are safety failures with no adversary at all. The Replit deletion was exactly that kind of failure. Attackers make the problem worse, through the goal hijacking we covered in our prompt injection guide and the stolen agent credentials in our offensive AI analysis, but an agent with too much authority is a risk before anyone attacks it.
Every agent is an identity, and AI agent governance starts there
Agentic AI security is less exotic than it sounds. OWASP’s Top 10 for Agentic Applications opens with agent goal hijack, tool misuse, and identity and privilege abuse, and two of those three are permission problems an identity team already knows how to frame. An agent is a new kind of non-human identity, with the same accountability gap we described in our non-human identity post, plus the ability to decide what to do next.
So our governance model treats each agent the way a mature program treats a privileged service account. It has a named human owner who answers for what it does. It runs on credentials scoped to its task, never on a person’s full session. Actions that cannot be undone (sending money, deleting data, granting access, deploying to production) require a human approval step. There is a tested way to revoke it in minutes, and a log a reviewer can read afterwards. Replit’s own fix after the deletion had exactly this shape, with automatic separation of development and production databases and a planning-only mode announced as in progress. Architecture did what an instruction could not.
The market has noticed, and identity vendors and AI security platforms now sell agent inventory and access governance. Evaluate them against that model as options, not as the model itself.
The board needs an AI risk appetite statement, not a tool list
Here is the answer we would give, written as an AI risk appetite statement short enough to approve in one meeting.
We encourage AI that advises (drafting, summarizing, analyzing, recommending) anywhere our data classification allows. We permit AI that acts only through identities we own, each with a named owner, credentials scoped to its task and human approval for any irreversible action. Every quarter we will report how many agents we run, how many meet that standard, how fast we can revoke one, and every incident or near-miss.
That statement does three things a policy list cannot. It tells the business yes before it says no. It draws the line at authority rather than at brand names, so it survives the next product launch. And it commits the security team to numbers the board can hold it to. When we help organizations build this in our AI governance and assurance work, the statement takes an afternoon, and the inventory behind it takes the quarter.
What to ask your team this week
- Which AI agents in our environment can act, not just advise, and who owns each one by name?
- Which of those agents run on a person’s credentials rather than their own scoped identity?
- Which irreversible actions (payments, deletions, access grants, production deploys) can an agent take today without human approval?
- If an agent misbehaved at 2 a.m., how long would it take us to revoke its access, and have we ever tested that?
- What agent incidents or near-misses have we had this year, and did anyone outside the team that built the agent hear about them?
Bottom line
Answer the AI usage question with yes, then draw the line at authority. Let AI advise freely within your data rules, let it act only through owned, scoped identities with human approval for irreversible steps, and report the agent inventory to the board every quarter. The Replit agent confessed after the fact. A governed agent would never have held the permission that made a confession necessary.