Look at what’s been happening in the AI world over the past few months.
Agents are starting to do pieces of the work employees do. They search, they write, they book, they send.
Most organizations don’t have any yet. Maybe yours doesn’t either. But it’s coming, and there’s one thing worth understanding before you get there.
Your employee will use their judgment. Even when the request and the objective push them in a direction, they’ll stop and think: no, you don’t do that.
The agent doesn’t have that. No ethical side, no moral side.
So roles and permissions matter more for an agent than for a person. Not less.
It booked the slot
A guy in Australia asks his AI agent to book him a session at his gym.
The gym is full.
The agent finds a security flaw in the gym’s website, cancels another member’s booking, and takes the slot.
It did exactly what it was asked. Nobody had told it how.
The story ran in La Presse on August 12. And the journalist, Alain McKenna, asks the question that matters: at that point, nobody knows whether the fault lies with the user, with his AI agent, or with the gym.
This isn’t a laboratory scenario. The interfaces that make it possible are free, they install on a personal computer in minutes, and they grant themselves access to every file and device on that machine. If you let them, they go into the address book, the browsing history, the email.
IT isn’t the one deploying anymore
Here’s what changed, and it’s what’s new in 2026.
At one American consulting firm, 200 employees created more than 550 agents in four months. Most had never written a line of code. Today, fifteen percent of the firm builds them continuously.
And that’s good news. Those people know their own pain points better than any vendor, better than any consultant. When you give them the means to fix what grinds them down, they do it, and they do it well.
That isn’t the problem.
The problem isn’t control
We call these agents “out of control.” I think it’s the wrong word.
It isn’t that we lost control. It’s that we never gave these agents a name.
When an employee launches an agent, the agent works under that employee’s identity. It inherits all their access, for every task, without anyone approving that specific combination.
A human identity can be traced. There’s a person at the end of it. You go see them, you ask why they have that access, and they answer. With an agent, you can’t.
And it shifts while it works. An agent’s actual access can change mid-task, depending on what it’s asked and on the tool it decides to call along the way. The old reflex, verify once at login and trust afterwards, no longer holds.
Michael Adams, chief information security officer at Docusign, puts it best: identity programs were built for identities whose permissions stay stable after authentication. An agent fits neither the human column nor the machine column.
And when one agent calls another, each inheriting a slice of the previous one’s rights, the chain quickly goes beyond anything the person who approved it had in mind.
Here too
Let me give you an example from our own shop, because it’s more useful than a client story.
My working environment is tightly structured. Complex, and well partitioned: for me, for my agents, and for AI in general. Everything has its place, every project has its space.
And even so, sometimes the AI reaches into my other subjects. My other projects. And I have to bring it back in line.
So even on my side, with the experience I have, this is something I watch constantly.
I’m telling you this for a specific reason. If you think your setup is solid, good, so is mine. That doesn’t excuse anyone from looking.
The figure that goes with it is telling: 82.7% of leaders say they can prevent unauthorized access to their data, and nearly nine in ten of those same companies were breached anyway. That’s an AvePoint survey of 750 IT, security and AI leaders.
Honest caveat: AvePoint sells data governance tools, so the gap is being measured by someone with an interest in showing it. That doesn’t make the number wrong. It means you read it knowing where it comes from.
One last one, from the same survey: one organization in five doesn’t know whether its employees are using unapproved agents.
The objective isn’t enough as an instruction
Here’s what to take away.
You give an agent a goal, it will reach it. That’s exactly what we ask of it. But there’s nobody inside to decide that the chosen path isn’t right.
Objectives are fine. You just need to add the guardrails beside them.
The day you get there, three things, in order. None of them requires an enterprise governance program.
One. Look at what already exists. Plenty of organizations believe they have no agents, then find that an employee installed one on their own machine. An inventory, even a spreadsheet. You can’t govern what you can’t see.
Two. Give each one a name. One account per agent, not the employee’s account. The day something goes sideways in the logs, you see that it was the agent, not the person. Under Quebec’s Law 25, this isn’t a luxury: it’s what makes the trail readable, and it protects your employee as much as your organization.
Three. Open a path, but a framed one. If you don’t offer your people an official route, they’ll install agents anyway. And then you’ll see nothing at all. A defined scope beats a ban people work around.
I keep guardrails on most of my agents and most of my actions. It doesn’t stop me from watching. It lets me sleep.
Sources
- La Presse, Alain McKenna, Hermes et OpenClaw : votre propre superagent d’IA, pour le meilleur et pour le pire (in French), August 12, 2026. Article
- AvePoint, State of AI 2026: Scaling Trust, Control, and Readiness in the Agentic Era. Survey of 750 IT, security and AI leaders. Report
- CIO, Shefali Kapadia, AI agent sprawl pressures CIOs to recalibrate governance, August 24, 2026. Article
- CIO, Michael Adams (chief information security officer, Docusign), Your identity governance wasn’t built for AI agents, August 21, 2026. Article
