For most of the short history of enterprise AI, models answered questions and people decided what to do with the answers. That arrangement is ending. AI agents now read inboxes, open tickets, query databases, modify configurations, and interact with other software on someone's behalf, often without a person reviewing each step.
That shift raises a question most organizations cannot yet answer with confidence: when an agent takes an action, who is accountable for it? Not in the abstract sense of "the company," but specifically. Which agent acted, on whose authority, with what access, and can anyone prove it afterward?
The Problem
The core problem is that enterprise identity was designed around people, and agents do not fit that design.
Directories, access reviews, and privileged access tools all assume a human sits at the origin of every identity. Someone is hired, gets accounts, has a manager, changes roles, and eventually leaves. Joiner, mover, and leaver processes, along with periodic access certifications, all depend on that assumption. Agents arrive by a different door.
A developer builds one in an afternoon. A business user assembles one in a low-code platform. An automation platform spins one up, and sometimes another agent does. Once agents can create, orchestrate, or invoke other agents, ownership and accountability become increasingly difficult to track. Each agent brings its own app registrations, credentials, tokens, or delegated permissions, and little if any of it passes through traditional HR processes or access review cycles.
An agent is also not just another service account. A service account executes predefined logic. An agent interprets goals, selects actions, and adapts its behavior based on context. That combination of real access and independent judgment is what makes agents valuable, and what makes them difficult to govern.
In practice, the accountability gap comes down to three questions that most organizations need to answer.
1. Who are the agents in my environment, and where are they?
Agents live across platforms such as Copilot Studio, cloud AI services, developer frameworks, and SaaS applications, each with its own console and administration model. Few organizations have a complete inventory, and agents often outlive the projects or individuals that created them.
2. What can they connect to and how?
Security teams need to know who can invoke an agent, which systems it can access, and which actions it can perform within those systems.
3. How can I control what they do?
Visibility alone is not control. Teams need to decide which actions each agent may take, require human approval where the stakes are high, and revoke access the moment circumstances change. That is harder than it sounds, because an agent's access is often not its own. They can scale and be ephemeral. It may act as the person invoking it, or it may operate using credentials stored by its creator. In the latter case, anyone who can interact with the agent may effectively borrow the creator's access, and privilege escalation means that access rarely appears in the requester's own access reviews or privilege reports.
None of these are hypothetical edge cases. They follow directly from how today's agent platforms work, and they become more significant with every agent added.
Why This Is a Growing Enterprise Concern
It is clear that agent adoption is progressing faster than the controls intended to govern it. Three pressures are converging.
Volume
Palo Alto Networks' 2026 Identity Security Landscape survey of 2,930 security decision-makers reports an average of 109 machine identities for every human identity, including 79 AI agent identities. Respondents expect agent identities to grow by 85% over the next twelve months compared to 56% growth for human identities. These figures are self-reported and should be interpreted accordingly. However, the direction is consistent with what we see across the industry: agent populations are growing rapidly.
Access Without Containment
The same survey found that approximately 40% of AI agents already have access to organizational data. Yet fewer than half of organizations apply foundational lifecycle controls such as behavioral monitoring or credential revocation to agents. Only a small minority explicitly classify machines with sensitive-data access as privileged identities. In other words, many organizations recognize that agents exist but have not extended their privilege model to include them.
Rising Autonomy
Gartner predicts that by 2028, one-third of enterprise software applications will contain agentic AI capabilities and that 15% of day-to-day work decisions will be made autonomously. In related research, Gartner also expects more than 40% of agentic AI initiatives to be canceled by the end of 2027, citing inadequate risk controls among the contributing factors.
Governance is not simply a security issue. It is becoming one of the factors that determines whether agent programs survive and scale. Around these trends sit two additional challenges:
Delegation chains are growing longer. A person invokes an agent, which calls a tool, which triggers another service, which invokes another agent. With each hop, establishing who authorized what becomes harder.
At the same time, auditors, insurers, regulators, boards, and customers increasingly expect organizations to demonstrate how access is granted, reviewed, and controlled rather than merely asserting that it is.
An agent that cannot be traced back to an accountable human is a finding waiting to happen.
What the Ideal Solution Looks Like
The ideal outcome is straightforward to describe: every agent action should be traceable to a specific agent, a specific accountable human, and a specific policy decision. Achieving that outcome requires a collection of principles working together rather than a single control.
1. Treat Agents as First-Class Identities
Agents should be discovered, inventoried, and governed as their own identity type rather than hidden inside applications or categorized as service accounts. You cannot govern what you cannot see.
2. Give Every Agent an Accountable Human
Every agent should have a clearly identified owner. Ownership must survive organizational change. When an employee changes roles or leaves the company, agent ownership should transfer rather than becoming orphaned.
3. Cap Agent Authority at Human Authority
An agent acting on behalf of a person should never be able to do more than that person could do directly. If the person's access changes, the agent's effective authority should change with it.
4. Govern Actions, Not Just Applications
Saying that an agent can access the CRM is too coarse a level of control. Administrators need to define which actions are allowed, which require human approval, and which are prohibited altogether. Default-deny should apply wherever permissions are not explicitly granted. High-impact actions such as mass exports, bulk updates, or irreversible changes deserve additional constraints.
5. Enforce Controls Continuously
Agents operate at machine speed. Controls evaluated only at login or in retrospectives are insufficient. Rate limits, session restrictions, and revocation controls must apply to active runtime sessions.
6. Record the Entire Decision Chain
Every action should generate a single record that identifies:
- The human
- The agent
- The client
- The target application
- The tool invoked
- The policy that allowed or denied the action
That record turns "we think it was fine" into evidence.
7. Keep Humans and Agents in One View
Managing agents as a separate governance silo misses the most important question: What can a person actually access once their agents are included? Only a unified view of humans and agents reveals that true footprint.
We are not alone in reaching these conclusions. In July 2026, Google introduced Beyond Zero, a security model that extends zero trust into the authorization layer so that every action inside an enterprise, whether taken by a person or an agent, is evaluated at the level of the specific action and resource, continuously and at machine speed. It describes an internal Alphabet architecture rather than a commercial product, but its direction closely matches principles 4 and 5 above. Our emphasis adds a second question: not only whether an action should be allowed, but who answers for it.
Agent platforms are evolving rapidly, and standards for agent identity and delegation are still emerging. Nevertheless, these principles provide a useful yardstick for evaluating any approach, including our own.
How NewCore Advances This Ideal
Our starting point is simple: governance becomes easier when agents are treated as identities rather than as applications, service accounts, or disconnected automations. We believe agents belong in the same identity fabric as the people they work for. Rather than introducing a separate agent governance silo, we place agents into the same graph as users, accounts, and applications, allowing organizations to understand accountability and access as a single system.
We believe every agent should have a discoverable identity, a clearly accountable owner, and an authority model derived from the human it serves. With NewCore, that translates into discovering agents across supported platforms, modeling them as a first-class identity type, linking each one to an accountable owner, and identifying agents whose ownership cannot be resolved.
Agent access is derived from the owner's application assignments, helping ensure that agents remain within the authority of the humans they represent. We also believe governance should operate at the level of actions rather than applications alone.
To support that model, we are building per-application tool permissions where individual actions may be allowed, routed for human approval, or denied outright, with default-deny behavior for anything not explicitly authorized. Furthermore, we are introducing additional runtime controls including rate limits, session restrictions, and safeguards around high-impact actions. Revocation decisions are intended to reach active agents within minutes rather than waiting for periodic review cycles. And critically, every tool invocation generates an auditable record linking the human, agent, client, application, tool version, and governing policy decision.
Finally, we are extending the identity graph to help organizations understand effective access: not just what a person can reach directly, but what becomes reachable through their agents as well.
Several design decisions illustrate how we think about accountability in practice:
- An agent can never approve its own request.
- When a tool invocation requires human approval, that decision goes to the accountable owner. If no response arrives within the required timeframe, the request is denied.
- When a connected service changes the behavior of a tool, the affected tool is suspended until an administrator reviews the change.
- When an administrator modifies a shared policy, the system surfaces every affected policy relationship before the change is committed.
Each of these decisions favors a clear, auditable "no" over a silent "yes."
Why We Believe This Is One of the Most Important Issues Organizations Face
Agent accountability will shape how far and how safely enterprises can adopt AI. Not because agents are uniquely dangerous, but because they combine three characteristics organizations have never had to govern together:
- Real access
- Independent judgment
- Machine speed
Every previous wave of enterprise technology eventually developed an accountability model. Employees have managers and access reviews. Applications have owners and change controls. Agents are already performing consequential work inside enterprises, often without a mature accountability model in place.
The gap does not remain static. Every new agent introduces additional access paths, permissions, and decisions that may not be fully understood or reviewed. Organizations that close this accountability gap early will be able to embrace agent adoption with confidence. They will be able to demonstrate who owns each agent, what it can access, what actions it can perform, and why those actions occurred.
Leading organizations already understand that governance is an enabler, not a constraint. Organizations that do not grasp this now will eventually face a more difficult choice: slow adoption while controls catch up, or accept risks that cannot be measured, explained, or reliably audited. That is why we are building agent governance into the identity fabric itself rather than treating it as a separate control layer. As agents become participants in enterprise workflows, accountability cannot remain optional.
Sources
- Palo Alto Networks, 2026 Identity Security Landscape (preview report, survey of 2,930 security decision-makers)
- SD Times, Gartner: More than 40% of agentic AI projects will be canceled in the next few years (June 30, 2025)
- Google, Going Beyond Zero: A New Paradigm For Enterprise Security (July 27, 2026)