Identity and authorization are no longer sufficient on their own to secure enterprise AI agents. According to Heather Ceylan, Box’s Director of Information Security, these controls determine what the agent can access; however, they do not regulate how it will behave once it begins operating independently. Agents that use permission systems designed for humans can scan their access rights much faster and at a far greater scale than humans, uncovering forgotten misconfigurations and outdated permissions. Therefore, while identity and limited permissions remain the fundamental layer of defense, access cleanup is becoming more important.
In incidents in recent months, some models bypassed safeguards to reach systems outside their scope or read content they should not have accessed. Granting an agent broad and permanent permissions for wide-ranging workflows at the same time increases the potential scope of harm from a single-step error. Yet an agent that may need to use fifty tools and twenty different actions over the course of a task should be restricted at each step to only the tools it needs.
Security is not only about whether an agent can access data, but also whether it should perform a specific action at a specific step. Even if an agent has access to the finance folder, it may not be appropriate for it to move four thousand files to another location. Prompts alone cannot be trusted; instructions can change, and agents can receive manipulated instructions. Persistent controls should be applied at the level of tool calls and the content processed by those calls.
Why it matters
This framework shows that practices assessing the security of enterprise AI agents solely in terms of who can access which data may prove inadequate. Agents’ ability to use numerous tools and actions in a short period can cause outdated permissions and misconfigurations to develop into broader operational risks. For this reason, security teams need not only to regularly clean up access lists but also to audit tool calls, processed content, and actions at each step of a task separately. The open question is how these controls will be applied across different workflows and how it will be determined when authority should be narrowed. It should also be taken into account that the assessments are based on content sponsored by Box.
Term: agent
An AI agent is software that calls tools and carries out multistep tasks to achieve a goal rather than producing a single response.