Enterprises have spent decades building security around a familiar question: Who are you?
Identity and access management (IAM), authentication, service accounts, OAuth tokens, and role-based access controls all start there. Establish identity, assign permissions, and control access.
Agentic AI changes the equation.
AI agents do not simply access systems. They reason, select tools, call APIs, retrieve data, execute multi-step workflows, and act as insiders making decisions at machine speed. That means enterprises need to answer a second, increasingly important question:
What is this agent actually doing right now?
That distinction sits at the center of the new Enterprise Management Associates (EMA) report, Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise. The research paints a troubling picture: enterprises have moved agents into production faster than they have built the infrastructure needed to govern their behavior.
Agentic AI has already crossed the production threshold
Agentic AI is no longer an experimental technology confined to innovation teams. Enterprises now use agents to reset passwords, triage security alerts, generate and commit code, handle customer interactions, and automate workflows that touch sensitive systems and data.
According to EMA, 46% of enterprises are already scaling agentic AI across multiple departments. Yet 47% cannot reliably inventory all deployed agents, and 55% lack fully integrated governance processes. Meanwhile, more than 92% report increases in AI- and bot-driven API traffic.
The problem is not simply visibility. It is control.
EMA found that 65% of enterprises have already experienced an AI agent acting outside its intended scope. Twenty-nine percent experienced measurable organizational impact, while another 36% caught a near miss before damage occurred.
Those numbers should change how security teams think about agentic AI.
The question is no longer whether an agent could exceed its intended authority. It is how enterprises detect and stop that behavior in real time.
Identity is necessary. It isn’t sufficient.
Agent identity remains foundational. You need to know which agent made a request and on whose behalf it operates. EMA found that 54.5% of organizations require and enforce unique identities for every AI agent. Another 32.2% require unique identities but do not consistently enforce the policy.
But knowing an agent’s identity does not tell you whether its current action makes sense.
Imagine a customer-support agent legitimately authenticated to several enterprise systems. It might need permission to retrieve customer records, review orders, and initiate a refund.
Traditional identity controls can answer whether that agent has permission to access those resources. However, they cannot determine whether downloading thousands of customer records, calling an unrelated administrative API, or issuing hundreds of refunds falls within the agent’s assigned task.
That is the critical distinction between identity and behavior.
An authenticated agent can still behave incorrectly. A valid credential can enable a sequence of individually legitimate actions that add up unacceptable behavior. And because agents dynamically plan and execute sequences of actions, the risk grows as their available tools and permissions expand.
EMA’s data shows where that breaks down. Only 34.2% of organizations evaluate authorization when an agent attempts a specific action. Most rely instead on periodic reviews or standing permissions established earlier. Those permissions accumulate into entitlements that may bear little relationship to what an agent needs for its current task.
For agentic AI, authorization therefore needs to become a runtime discipline, not merely a provisioning event.
Governing behavior means evaluating actions in context
The emerging model looks much closer to zero trust: authenticate the agent, but never assume authentication makes every subsequent action trustworthy.
Chase Cunningham, “Dr. Zero Trust,” extends this principle in his Agentic Zero Trust model. Cunningham argues that traditional zero trust remains necessary, but its implementation must evolve because AI agents differ fundamentally from human users and deterministic workloads. Traditional zero trust asks whether a particular identity should access a resource. Agentic zero trust adds another question: Should this autonomous system take this particular action, in this context, as part of the job it was assigned to do?
That extension matters because identity and authorization can both work exactly as designed while an agent still produces a dangerous outcome. Identity answers, “Is this the agent it claims to be?” Authorization answers, “Is this action permitted?” Behavioral intent asks, “Is this agent behaving consistently with what it was deployed to do?” In other words, Agentic Zero Trust extends “never trust, always verify” from access decisions to agent actions and intent.
This approach does not replace identity. It makes identity actionable by combining who the agent is with what the agent is doing.
Machine-speed agents require machine-speed containment
Runtime governance also matters because human-speed incident response cannot keep pace with autonomous software.
EMA found that only 32.2% of organizations can detect and contain out-of-scope agent behavior within minutes using automated mechanisms. Another 54.5% need hours and manual containment steps. More concerning, 3.5% first discover rogue agent behavior when a customer or external partner reports it.
An autonomous agent can execute hundreds or thousands of actions while a security team investigates an alert. Logging the behavior is not enough. Enterprises need an enforcement point capable of constraining or blocking an agent when its behavior crosses defined boundaries.
Auditability presents another problem. 46.1% of respondents cannot easily produce a complete record of a specific agent’s actions over the previous 30 days. That makes basic incident-response questions—what did it access, what data did it touch, and what actions must we reverse—difficult to answer.
MCP makes behavioral governance even more important
Model Context Protocol (MCP) dramatically simplifies how agents connect to enterprise tools and data. It can also dramatically expand their reach.
EMA found that 56.4% of organizations limit MCP connections to an approved list. Yet among those organizations, fewer than half have a dedicated governance team regularly maintaining that list.
Approving an MCP server or API does not mean every action through it should remain authorized forever.
Enterprises therefore need governance across the entire interaction: agent → model → MCP server/tool → API → application and data. Trusted registries help establish what agents may reach, while runtime controls determine whether an individual action belongs within an agent’s current behavioral boundaries. Cequence AI Gateway provides both types of controls across MCP servers, APIs, LLMs, and skills.
Governance must move into the runtime
EMA’s conclusion is straightforward: “Govern what agents do, not just what they are.” The research recommends task-specific authorization evaluated at execution time, automated detection and containment before enterprises scale deployments, and rigorous decommissioning when agents or pilots reach end of life. This represents an important evolution in enterprise security.
Identity tells you who has entered the building. Behavior tells you whether they are doing their job. Agentic AI requires both.
As enterprises give agents greater autonomy across APIs, applications, MCP servers, models, and sensitive data, successful governance will depend on continuously connecting identity to behavioral intent and action. The organizations that make that shift can move beyond merely knowing which agents they have, and ensure those agents stay within the job they were actually given.
The Cequence AI Gateway operationalizes these concepts at runtime. It authenticates agents, evaluates tool calls against policy, applies least-privilege controls, monitors and logs behavioral deviations, and enforces controls outside of a model’s reasoning loop. Learn more about Cequence AI Gateway, or request a demo to see firsthand how we can help in your environment.
