Artificial intelligence is moving from answering questions to taking action. For the past few years, most workplace AI conversations have focused on what employees can ask AI to do. Write an email. Summarize a document. Analyze information. Help prepare a presentation.
That conversation is changing.
A new generation of AI tools, often called AI agents or agentic AI, can be given permission to perform actions on a user’s behalf. Depending on the tool and permissions involved, an AI agent may be able to access files, interact with applications, navigate websites, retrieve business information, and complete multi-step tasks.
That creates enormous potential for productivity. It also changes the decision businesses are being asked to make.
Preparing for agentic AI is not simply about deciding which tools employees can use. Leaders also need to consider what authority those tools should have, who can approve that authority, and where human oversight should remain.
That leads to what may be the next major AI decision for business leaders:
What should AI be allowed to do inside your organization?
Why agentic AI matters now
In August 2026, the National Institute of Standards and Technology (NIST) highlighted a familiar pattern emerging with agentic AI: organizations are moving quickly to capture productivity and business value while security practices struggle to keep pace.
NIST’s guidance on agentic AI focuses heavily on identity and authorization. If software can act on behalf of a person, organizations need a reliable way to determine who or what is acting, what it is authorized to do, and how that activity can be traced back to a responsible user or system.
That does not mean businesses should avoid AI agents. It means the conversation needs to move beyond whether employees are allowed to use AI.
Giving an employee access to an AI assistant is one decision. Giving software authority to act using that employee’s access is another.
Quick gut check: If an employee asked today to connect an AI agent to their email, files, calendar, and business applications, who in your organization would decide whether that access was appropriate?
When AI becomes a permissions question
Most employees requesting AI tools are not trying to create risk. They are trying to solve a problem or work faster.
That is exactly why governance can become difficult.
The productivity benefit of a tool may be immediately obvious. The consequences of the permissions required to deliver that benefit may not be.
NIST has made this issue a specific area of research. In February 2026, the agency published a concept paper on the identity and authorization of software agents. The work examines identification, authorization, auditing, and how organizations can apply established access-management practices to AI agents.
The principle of least privilege becomes especially important here. An agent should not automatically receive every permission available to the employee using it simply because that is the easiest way to make the tool work.
The technology may be new. The underlying security question is familiar:
Who has access to what, and what are they allowed to do with it?
More authority can mean more impact
Agentic AI also changes the potential consequences when something goes wrong.
An agent may encounter information from websites, emails, documents, databases, or other outside sources while completing a legitimate task. Some of that information could contain malicious instructions designed to manipulate the agent into taking an unintended action.
This is known as indirect prompt injection.
In March 2026, NIST published results from a large-scale AI agent red-teaming competition examining this type of agent hijacking. Researchers tested more than 250,000 attack attempts against 13 frontier models and found at least one successful attack against every model tested.
The business lesson is not that every AI agent will be compromised. It is that the consequences of an AI mistake or manipulation increasingly depend on the authority the agent has been given.
A system that can summarize a document has one level of impact. A system that can send messages, modify information, run commands, or interact with other applications has another.
Productivity can create shadow AI
Organizations have dealt with shadow Information Technology for years. Employees adopt applications or services without formal review because those tools solve an immediate problem.
AI can create a similar challenge, but with an important difference.
An unapproved application may introduce another place where company information is stored. An AI agent may also be granted authority to operate across systems the employee already uses.
One employee connects an AI tool to a calendar. Another connects one to email. A department finds a tool that can update records or automate a workflow. Each decision may seem reasonable on its own.
Over time, the organization can end up with overlapping access, inconsistent controls, and no clear picture of who approved what.
The goal should not be to discourage employees from finding better ways to work. It should be to make sure convenience does not quietly create authority that no one is responsible for reviewing.
Preparing for agentic AI
Businesses do not need a complicated AI governance program before they can begin addressing this issue.
They do need a consistent way to evaluate requests.
Information Technology and cybersecurity teams should be part of that process, but these are not purely technical decisions. Leadership also has a role in determining whether the business value of an AI capability justifies the information and authority required to provide it.
Before approving an agentic AI tool, businesses should be able to answer:
- What business problem is the tool intended to solve?
- What company information does it need?
- What systems does it need to connect to?
- What actions will it be allowed to perform?
- Who approves those permissions?
- Can its activity be logged and reviewed?
- Who owns the tool after it is approved?
- How will access be removed when it is no longer needed?
- Which actions still require a person to approve them?
The answers will not be the same for every tool.
Reading a calendar is different from sending an email. Reviewing a document is different from deleting it. Summarizing financial information is different from initiating a financial transaction.
The amount of oversight should reflect the authority being granted.
Start with visibility before complexity
The security industry is beginning to formalize these ideas.
In September 2026, the Open Worldwide Application Security Project (OWASP) published its Agent Control Standard. The standard emphasizes that AI agents should be inspectable and traceable, giving organizations visibility into what agents exist, what they can access, what they did, and how their behavior can be controlled.
For many growing businesses, that points to a practical starting place.
Before building complicated policies, establish visibility.
Know which AI tools are being used. Know who owns them. Know what they are connected to. Know what authority they have been given.
Once that foundation exists, organizations can make better decisions about where stronger controls, human approval, or additional monitoring are appropriate.
The takeaway
The next major AI conversation for business leaders is not simply whether employees should use artificial intelligence.
It is about authority.
As AI moves from generating information to taking action, businesses will need to decide where that authority begins and where it should stop.
One practical step for the next 30 to 90 days: Create an inventory of the AI tools already being used or requested across your organization. For each one, document its business purpose, owner, connected systems, information access, and the actions it is allowed to perform.
That inventory gives leadership something concrete to evaluate before agentic AI adoption moves faster than the policies surrounding it.
Your next big AI decision may not be which tool to adopt.
It may be deciding how much authority you are prepared to give it.
