AI agents in automation: give each one the least access it needs

What was announced

At its Navigate 2026 event on 6 October, identity-security vendor SailPoint announced a set of capabilities aimed at AI agents. Its press release describes autonomous agents that use identity context to tell legitimate agent activity from malicious activity and to right-size permissions, expanded discovery of unsanctioned ("shadow") AI, runtime authorization, and a "kill switch" for agents. It also lists just-in-time access that applies to people, service accounts and AI agents.

According to the same release, some capabilities began rolling out globally at the event, while others are scheduled for the fourth quarter of SailPoint's fiscal 2027. These are vendor announcements about vendor products; we have not tested them and do not recommend any product here.

What the vendor survey reported

The same day SailPoint published its Horizons of Identity Security report. It states that 79% of the organizations surveyed run AI agents in production, while only 2% have deployed security tools built specifically for them. The survey covered 340 leaders and was run by a company that sells identity security, so read the figures as vendor-reported rather than as an independent measure of the market.

Even with that caution, the direction is useful: agents are being connected to real systems faster than the rules for what they may touch.

A rule a small team can apply without buying anything

Synthetic example: a fictional distributor connects an AI assistant to its shared inbox to draft replies. The simple version gives it full access to every mailbox and the invoicing system. The safer version gives it read access to one mailbox, the ability to save drafts but not send them, and no access to invoicing.

Before connecting any agent, write down four things: who owns it, which systems it can read, which actions it can take, and how to turn it off. If you cannot answer the last question in one step, it has too much access.

Start with drafts and approvals. Let a person confirm anything that spends money, deletes data or reaches a customer, and widen the agent's permissions only after you have reviewed a few weeks of its work.

Review it like any other process

Keep a short log of what the agent did and which errors a person had to correct. This is the same count-before-and-after method used in continuous improvement: if corrections fall, widen its scope a little; if they do not, narrow it or fix the instructions first.

Also remove access that is no longer used. Agents set up for a pilot are easy to forget, and a forgotten connection is exactly the kind of gap the vendors above are describing.