# Identity and Permissions Fail to Control Autonomous AI Agent Risks
Enterprise security teams face a fundamental problem: traditional access controls designed for humans cannot govern how autonomous AI agents behave once they start executing tasks. A system with legitimate permissions to access company data can still perform unintended actions at machine speed, creating security gaps that standard identity and access management (IAM) tools cannot close.
Heather Ceylan, chief information security officer at Box, articulates the core issue plainly. "Access controls and permissions are the foundation, but the challenge is they were designed for humans," Ceylan explains. "Permissions are still the foundation, but you have to think about how the agents get their permissions scoped as well."
The distinction matters. Traditional enterprise security relied on role-based access control (RBAC) and attribute-based access control (ABAC) systems that determine what users and applications can reach. A person with database access has database access. An application with file permissions can read those files. But an autonomous AI agent operates differently. Once granted access to legitimate enterprise resources, that agent makes independent decisions about how to use those resources. It can modify data, trigger workflows, send communications, or initiate transactions without human intervention between permission grant and action execution.
This execution layer creates the vulnerability. An AI agent given permission to read customer records and send emails could autonomously decide to contact every customer with marketing messages, or worse, craft and send phishing attempts using real company voice and access. The agent technically operates within its granted permissions. The problem is not access but behavior.
Box, a cloud content management platform, operates at the intersection of this problem. Its customers trust it with enterprise files, but increasingly those customers deploy AI agents that interact with Box systems to automate workflows. Those agents need access to sensitive documents. But Box and its customers need assurance that agents use that access appropriately.
The security shift moves beyond identity governance. Enterprises now require execution governance, which monitors and constrains agent behavior during task completion. This means setting not just "what" an agent can access but "how" it accesses resources and "what actions" it takes with accessed data.
Practical implementation approaches include intent verification, action auditing, and bounded execution. Intent verification confirms that an agent's planned actions align with its stated task before execution begins. Action auditing creates detailed logs of every operation an agent performs, enabling forensic analysis if something goes wrong. Bounded execution limits the scope of actions an agent can take in a single session, requiring human approval for operations exceeding defined thresholds.
The shift reflects a maturation of enterprise AI deployment. Early pilots often operated in sandboxed environments with limited access. Production deployments require agents to interact with live systems, real data, and genuine business consequences. That reality demands security controls that match AI capabilities, not human workflows.
Organizations starting with AI agent deployments should audit their current access control architecture and identify gaps between permission granting and action verification. As agents become standard infrastructure for enterprise automation, execution governance moves from optional enhancement to baseline requirement.