For companies introducing AI into their operations, what happens when an AI agent makes a mistake?
More specifically, how does an organization determine who was responsible for the action, whether the agent had permission to perform it and what went wrong?
These were among the questions explored during a conversation with Nick Taylor, a Developer Advocate at Pomerium, and Abdul Wahab Chauhdry, a Software Engineer and former Technical Lead at T-Mobile.
Taylor has spent more than two decades developing software, including engineering roles at Netlify and OpenSauced. His current work focuses on infrastructure security and the growing use of AI agents.
Chauhdry, who has more than 12 years of experience in software engineering, joined the conversation to explore how organizations can manage the security challenges that come with giving AI agents greater access to their systems.
When AI Acts on Behalf of an Employee
Companies have long used automated systems to perform tasks without requiring someone to manually initiate every action. These systems often operate through service accounts, which provide applications or automated processes with the credentials needed to access company resources.
But as AI agents become capable of performing more complex tasks, those arrangements can make it difficult to determine who initiated a particular action.
Taylor explained that assigning an identity to a bot or using a service account can help manage access, but it doesn’t necessarily establish who was behind an action.
If something goes wrong, the activity might be traced to a service account without identifying the employee who initiated it.
“You can’t really say like, ‘Hey, it was Nick,'” Taylor said.
The problem becomes more significant when multiple employees use AI agents to interact with the same systems.
Imagine an engineering team using AI agents to help maintain an application. An agent makes a change that causes an unexpected problem. When the team investigates, the activity is associated with a service account.
That record may identify the automated system involved, but it doesn’t necessarily reveal which employee initiated the request.
For engineering leaders responsible for maintaining reliable systems, understanding what happened is only part of the challenge. They also need to know how the action was authorized and whether it should have been permitted in the first place.
Should AI Agents Have the Same Permissions as Employees?
Chauhdry raised another question that organizations need to consider when introducing AI agents into their workflows.
If an employee has permission to make changes to a system, should an AI agent working on that employee’s behalf automatically receive those same permissions?
For example, a senior engineer might have access to modify production systems, while a junior developer has more limited access.
If both employees use the same AI agent, how should the system determine what each person is allowed to accomplish through it?
Taylor explained an approach that considers both the permissions assigned to the employee and the actions the agent is authorized to perform.
“What the agent can do with the access you have, the intersection there is what you can do with the agent,” Taylor told Developers.Net.
In practice, this means an AI agent would not automatically receive every permission available to the employee using it.
An engineer might have permission to modify a database, but an AI agent assisting that engineer could be restricted to reading information or performing specific approved tasks.
The distinction matters because an employee’s authority to perform an action doesn’t necessarily mean an automated system should have that same authority.
For organizations deploying AI agents, establishing those boundaries can help reduce the consequences of unintended actions.
Knowing Who Is Behind an AI Agent’s Actions
Restricting what an AI agent can do addresses one part of the problem. Organizations also need a way to understand who initiated its actions.
Taylor discussed work involving identity-aware access controls that connect an AI agent’s activity to the person requesting it.
The approach involves giving users separate environments for their agents and maintaining records of the actions performed on their behalf.
“auditability is super important,” Taylor said.
He explained that the goal is to preserve a record connecting the employee’s request to the agent’s activity.
“So you can literally say, ‘Okay, Nick said to do this thing.’ The agent might have done it on behalf of me, but there’s a trail of who is doing things.”
Taylor described this approach while discussing Run Identity, a technology Pomerium has been developing to help distinguish between human users and the AI agents acting on their behalf.
The underlying principle extends beyond any particular product.
Organizations need to be able to trace automated actions back to the people or processes responsible for initiating them.
That information becomes particularly important when investigating security incidents, troubleshooting unexpected changes or determining whether an AI agent operated within its intended permissions.
What Should Technology Leaders Consider Before Deploying AI Agents?
The conversation between Taylor and Chauhdry highlights a challenge that can be easy to overlook when evaluating AI’s potential to improve productivity.
An AI agent may be capable of completing a task, but that doesn’t mean an organization has established the appropriate controls for allowing it to do so.
Before expanding the use of AI agents, technology leaders should understand how their systems identify the people behind automated requests, what permissions those agents receive and whether their actions can be traced when something goes wrong.
Existing security practices provide a starting point, but organizations may need to reconsider how those practices apply when software is acting on behalf of employees.
The questions Chauhdry raised about permissions and identity are especially relevant as companies move toward AI systems that can perform tasks with less direct human involvement.
Giving an AI agent access to company systems is a technical decision. Determining what it should be allowed to do, and how the organization will account for its actions, requires a broader conversation about responsibility.
