AI agent permissions are outrunning security

The speed at which AI agents are being given authority is outpacing the controls that keep track of what they do.

A survey of 1,100 IT and security decision-makers found that 70% of organisations now allow AI agents to make decisions and take actions that would have required human approval a year ago ^[1]. Three in four organisations encountered at least one AI-related security issue or warning sign in the past year as a result of this expanded authority ^[1].

It's a bit like handing a teenager the car keys and the credit card on the same day. The agent can do more, faster, but the household budget and the fuel receipt don't always show who authorised what.

The permission creep

The survey, conducted by CyberArk, shows that the expansion isn't just happening in experimental corners of the organisation. AI agents are being granted access to business-critical systems, and the permissions they hold are often wider than those of the people who set them up ^[1].

The risk isn't that an agent will suddenly turn rogue. It's that when something goes wrong—a cancelled order, a changed record, an odd payment—the trail goes cold. The agent did what it was told to do, but by whom, and based on what instruction?

What the logs show, and what they don't

Logs are the record of what happened. They'll tell you that an agent changed a customer's delivery address at 14:32 on Tuesday, but they won't necessarily tell you whether the customer asked it to, or whether someone with access to the agent's API decided to test a new prompt.

The trouble is, logs are kept by the same systems that run the agents. If someone with the right access wants to tidy up after a mistake, or if an attacker gets in and tries to cover their tracks, the log is often the first thing that gets edited.

That's the evidence question: when you need to know what an agent did, and on whose instruction, can you show a record that nobody has quietly rewritten?

Sealing what the agent did

Here, the thing to seal is each instruction the agent receives, each tool call it makes and the result it gets back. Sealing takes a fingerprint of the record, not the record itself, so the details of what the agent did never leave your systems.

If a customer disputes an action six months later, or an auditor asks what happened on a particular day, anyone you share the record with can check that it's exactly what was logged at the time. Change a single character in the log and the fingerprint won't match.

What it shows is that the record hasn't changed since it was sealed. What it doesn't do is authorise the action, make it correct or prove that the agent should have had the permissions it had. Those are separate questions, and good ones to ask now.

You can seal agent actions through WitniumChain's MCP server, which integrates with agent frameworks. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. The agent framework sends a fingerprint of each instruction, tool call and result to WitniumChain as it happens.
2. WitniumChain seals the fingerprint and returns a witness ID.
3. When the record is questioned, you calculate the fingerprint again and check it against the sealed one.

What this means for you

If your organisation is giving AI agents more authority, three questions are worth asking this week:

• Do we know which agents have access to what, and who can change those permissions?
• If an agent does something we didn't expect, can we trace it back to an instruction, and can we show that the log of what happened hasn't been edited?
• Are we treating agent actions the way we'd treat actions by a person with the same level of access?

The gap between what agents can do and what we can verify is widening. Logs are a start, but only if they hold up when someone questions them.

What to watch

Under the AI Act, high-risk AI systems must technically allow for the automatic recording of events over their lifetime, for traceability (Article 12) ^[2]. For systems under Annex III, that applies from 2 December 2027 ^[2].

The Act doesn't define AI agents as a separate category, but a system that makes decisions about people, or that controls critical infrastructure, can fall under the high-risk rules. If an agent is part of such a system, the logging duty applies.

The question isn't just what to log. It's whether, when the log is needed, it will be trusted.