The security questions asked of an AI deployment tend to be about the model: which provider, where inference runs, whether prompts are retained for training. Those questions matter. They are also, in most enterprise deployments, less consequential than the question that rarely gets asked, which is what the agent is permitted to do once it decides to act.
An agent that reads open purchase orders and proposes accruals is a reporting tool. The same agent with authority to post the accrual is a privileged user, and every control you would apply to a privileged user applies to it: least-privilege scoping, segregation of duties, an audit trail that records intent alongside action, and a rehearsed path for revoking access quickly. Very few agent deployments arrive with those controls attached.
Prompt injection is what makes this urgent rather than theoretical. An agent that retrieves context from documents, tickets or email is consuming attacker-influenceable text, and instructions embedded in that text are not reliably distinguishable from instructions from the user. Mitigation sits partly at the model layer, but the durable control is architectural: constrain what the tools can do, so a successful injection reaches a bounded set of low-consequence actions rather than the full authority of the account the agent runs under.
Data leakage is the quieter failure. Prompts and responses are frequently logged in full for debugging, retrieved documents are copied into vector stores that inherit none of the source system’s permissions, and an agent serving several business units can surface one unit’s data to another through nothing more exotic than a similarity search. Permission-aware retrieval is harder to build than a single shared index, and it is the difference between an access control model and the appearance of one.
The practical step is to route agents through the identity and access process rather than through model procurement. Give each one an identity, scope its permissions to the narrowest set that lets it do its job, log what it did and why, and test revocation before you need it. The AI-specific controls sit on top of that foundation; without it, they are protecting an account that can already do too much.
