When the Tools Start Acting on Their Own: A Practical Guide to Agentic AI Security
Key Takeaways
Introduction
AI assistants used to answer questions. Now they act. They connect to your CRM, read your cloud, draft and send email, and work across browsers and code. That’s a big efficiency gain, and it’s also a new category of risk most organizations haven’t fully mapped.
In a recent internal session at Derive Technologies, our team took on a hard question: if an AI agent has access to business systems, what keeps it from doing something it shouldn’t? We didn’t settle every philosophical question about AI behavior, but we did reach a clear, practical answer about where to start.
What can an AI agent access?
The most important idea is also the simplest. An AI agent doesn’t come with its own permissions, but it can take on the rights of whoever connected it.
“AI agents are always proxies for people in terms of what they can access. They’re effectively inheriting the rights of some users.”
— Mitch Martinez
So the guardrails you already use for people are the same guardrails that limit what an agent can do. If a user can only read, an agent connected through that user can only read. If a user is a super admin, then the agent might be too. That’s why identity and access management is the starting point for agentic AI security.
Should your most privileged users connect AI agents?
Most organizations assume their power users should be first to adopt AI tools. From a risk standpoint, it’s the other way around: your most privileged users should be the least connected.
Our Director of Marketing, Gemma Lolos, described how she applied this. As an admin, her AI would have significant built-in access, so she set up her CRM connector to the AI model with read-only access.
A good rule of thumb: any super admin should connect AI tools with read access only. Users whose roles are already tightly scoped are much less of a concern, because their permissions limit anything the agent could do.
“You better think twice before you attach a super user account to an AI agent. I’m not saying you shouldn’t do it. I’m saying understand the ramifications, and what the stopgaps are in case it goes wrong.”
— Mitch Martinez
How do you monitor what an AI agent did?
Access control decides what an agent can do. Monitoring tells you what it did.
Most business systems already keep audit logs. Those logs record actions whether a person or an agent took them. The risk is permission drift: an agent with elevated rights changing its own access or someone else’s. That’s why audit review can’t be an afterthought.
“The audit process and the review of that audit has to be part of a regular cadence. It has to be baked in.”
— Mitch Martinez
Monitoring can happen in real time or after the fact through log review. AI can also help here: agents can watch other agents’ activity for anomalies like unusual data movement. For more on governing agents, see The Junior That Runs at Machine Speed.
Does data exfiltration look different when an agent does it?
No. When data leaves your organization, it goes over the network the same way no matter who sent it. Your firewall doesn’t know if it’s a person or an agent. That means the controls you already have for data loss still apply:
- Outbound thresholds at the firewall that flag or block unusually large transfers
- Email security that inspects what leaves through mail, on-premises or in the cloud
- Network monitoring at every exit point
An agent trying to export your contact list hits the same checkpoints a person would. The job is to make sure those checkpoints are configured properly.
What has to be in place before you turn on agentic tools?
For any business deploying coding assistants, browser agents, or anything with write access, our team’s baseline is:
- Identity and access management. Know exactly whose credentials each agent runs under.
- Least privilege. Give agents the minimum rights the task needs. Start read-only.
- MFA. Make sure every account an agent depends on is protected by multi-factor authentication.
- Zero Trust architecture. Verify every request, whether a person or a machine made it.
- Scheduled audit review. Logs only help if someone reads them.
- Exfiltration safeguards. Outbound controls at the network and email layer.
There’s also a point that’s easy to miss: vendor questions aren’t enough.
“Unless you’re working with a team like Derive Technologies that does the appropriate discovery, a plug-and-play vendor is not going to provide anything but general guidance. You need to ask yourself questions.”
— Mitch Martinez
What does this agent need access to? Whose account is it using? How would we know if something went wrong?
Frequently Asked Questions
What permissions does an AI agent have?
An AI agent has no permissions of its own. It inherits the access rights of the user account that connected it, so a read-only user produces a read-only agent and a super admin can produce a super admin agent.
Should administrators connect AI tools to business systems?
Derive’s rule of thumb is that any super admin should connect AI tools with read-only access. Users whose roles are already tightly scoped are much less of a concern, because their permissions limit what the agent can do.
How do you detect an AI agent misusing access?
Audit logs record agent actions the same way they record people’s, so regular log review catches permission drift. Real-time monitoring, firewall outbound thresholds, and email security add coverage for data leaving the network.
The Takeaway for IT Buyers
None of this argues against using AI. Our team uses it every day, and work that used to take hours now takes minutes.
The organizations that get the most out of agentic AI will be the ones that set it up deliberately: scoped access, real monitoring, and a clear answer to “who is this agent acting as?”
Ready to deploy AI without handing it the keys? Derive Technologies helps organizations assess AI readiness, tighten identity and access controls, and build monitoring that covers both people and agents. Start a conversation with our team.