AI governance must cover actual access and use

AI governance must cover actual access and use

AI governance must establish what the technology can access and how employees use it, even when an executive already owns the responsibility. Companies worldwide are adding agents, AI-enabled security tools and AI functions to internal systems. Security experts warn that deployment is outpacing the governance and safeguards needed to protect those systems and customer data.

Security leaders already see this gap as a major concern. In an October report from PwC, half identified protecting AI as their largest single preparedness gap, ahead of cloud-related threats, third-party breaches and ransomware. The wider survey covered more than 3,900 business and technology leaders in 71 countries worldwide. PwC provides risk and cybersecurity advisory services, so it has a commercial interest in companies seeking help to close that gap.

For executives and directors, this concern makes cybersecurity part of the decision to expand AI use. “I actually think we’re seeing a growing awareness among business leaders that AI opportunity and AI risk have to be considered together,” Tonya Ugoretz, co-leader of the Cyber and Risk Innovation Institute at PwC, told Cybersecurity Dive. Acting on that awareness requires someone to ensure security decisions happen before deployment. To do that, they need to understand the access and activity they oversee.

Executive ownership needs clear deployment responsibilities

Establishing who makes those security decisions is difficult when organizations assign AI responsibility in different ways. “Our findings show there isn’t yet one ownership model for AI governance and risk,” Ugoretz said. PwC attributed less than 30% of AI accountability to chief information officers (CIOs), chief technology officers (CTOs) or other technology leaders. About one-quarter of organizations had a dedicated AI executive, while 17% reported that accountability for AI rested with the CISO, or chief information security officer.

These assignments leave practical questions about responsibility during implementation. Many companies lack clarity about who introduces AI and who can require protections for data and critical systems, so an executive appointment can leave security decisions unresolved. Leaders need to establish who reviews a proposed use, who determines the necessary protections and who ensures those protections are considered before deployment.

For boards, the useful test is whether senior responsibility extends to those implementation decisions. An executive owner needs to know who can explain a deployment’s purpose, approve its access and oversee its activity. These questions become especially concrete with agents: their ability to act depends on the permissions of the account under which they operate.

Agents can create risk through authorized access

An AI agent is software that can carry out tasks with some degree of autonomy, using an operating identity, the account through which it accesses systems and information. That account’s permissions determine what the agent can reach and do. An agent can therefore expose information or systems through access the organization has already authorized.

Useful access is part of the appeal as companies commit substantial resources to agentic AI tools, which use agents to perform work. Companies want these tools to improve productivity or make existing products more efficient, and those goals encourage them to give agents access to business systems. Cyber risk leaders must assess how much access the tools receive and whether human oversight is sufficient to monitor their activity.

The account behind that access is central to the risk, according to George Gerchow, chief security officer at Bedrock Data, a data-security vendor with a commercial interest in demand for protections around AI access. He told Cybersecurity Dive: “An agent inherits the access of whoever it runs as. It never has to break it, it walks through the doors we left open.” The route to information or systems may already be permitted.

Reviewing that access requires examining the agent’s operating account and identifying a person responsible for it. “Treat every agent as a new identity with a named human owner,” Gerchow said. Leaders then have someone to ask about the agent’s purpose, permissions and supervision. To judge whether that supervision is adequate, the owner must understand both the information available to the agent and the actions it can take.

Some organizations are limiting those actions in uses they consider especially risky. A third-quarter KPMG report found that 49% of organizations had established high-risk use scenarios that limited autonomous-agent access, compared with 28% in the same quarter the previous year. KPMG provides risk and technology advisory services, so it benefits commercially from demand for help governing AI. Its finding describes restrictions applied to designated high-risk scenarios.

These restrictions give an agent’s owner specific limits to oversee. For each deployment, leaders can ask which uses trigger tighter access, what the agent can still do and how a human monitors that activity. The answers connect the named owner to the agent’s actual authority and make clear why security reviews must examine activity that existing permissions allow.

Approved third-party tools need continuing access oversight

Access reviews must also cover external AI tools, which many companies obtain through third-party software rather than develop internally. Adopting these tools brings the vendor’s technology and its connections to company systems into the governance decision. Approval therefore needs to account for both the information the tool can reach and its authority within connected systems.

That authority can be extensive because third-party tools often receive access to sensitive information and privileged connections, which grant elevated access to systems or actions. Security leaders may struggle to see what happens through those connections. An AI tool can reach information that existing security tools cannot see, leaving the organization with an incomplete view of its activity. Internal owners need technical visibility to understand what they oversee.

Vendor assessments must therefore examine how the technology connects to the organization. Pasha Sternberg, a principal and privacy and cybersecurity attorney at Polsinelli, identified the requirement: “So, vetting those vendors from both a cybersecurity and a technical standpoint”. The firm provides privacy and cybersecurity legal advice, so it benefits from companies seeking help with these risks. For executives approving external AI, Sternberg’s advice means examining the tool’s connections and access during the vendor assessment.

Those connections matter after purchase or adoption because the tool continues to use the permissions it receives. Boards can ask what sensitive information and systems approved tools can reach, and where security teams lack a view of that activity. Vendor review and continuing oversight cover tools the organization knows it uses. Employee-downloaded applications create another problem: the application itself may be unknown.

Employee-downloaded AI extends governance beyond approved deployments

Employees also introduce AI through applications the organization has neither authorized nor vetted, a category known as shadow AI. They download these tools to improve productivity, learn a skill or use them for personal purposes. Actual AI use therefore extends beyond formally approved deployments to applications that may interact with business systems or customer data.

Unapproved use can begin with the same productivity goal that drives company investment in agents. Yet the organization may know little about how an employee’s chosen application handles information or connects to its environment. Legal experts warn that companies do not sufficiently understand the implications of unsanctioned tools their employees use. Without knowing about an application and its use, security teams have less ability to assess the risk, manage the activity or apply protections.

The potential exposure prompted the National Cyber Security Centre in the U.K. to warn last month that shadow AI can create unintended risks within enterprises. An employee may download an application for an ordinary, useful purpose, but its interaction with the company’s environment can still require safeguards. The employee’s reason for using it therefore answers a different question from whether the organization can oversee its effects.

Oversight starts with knowing the application exists. “It’s hard to secure and manage what you don’t know exists,” said Sarah Glover, a shareholder and privacy and cybersecurity attorney at Polsinelli, whose legal practice has the same commercial interest in demand for privacy and cybersecurity advice. Her observation identifies a visibility problem distinct from monitoring an approved vendor’s connections: security teams need a way to identify employee-downloaded AI before they can assess its access to business systems and customer data.

Key highlights

• Connect governance to actual use: AI governance needs visibility into what tools can access and how employees use them. Boards can test coverage by asking who approves access, monitors activity and addresses gaps before deployment.
• Define deployment responsibilities: Executive AI owners need clear assignments for reviewing proposed uses, setting protections and approving deployment. These responsibilities connect senior accountability to specific security decisions.
• Give every agent a human owner: An agent inherits the permissions of its operating account, creating risk through authorized access. A named owner needs to understand those permissions, define limits for high-risk uses and oversee the agent’s activity.
• Monitor vendor access after approval: Third-party AI tools can receive sensitive data access and privileged system connections. Security and technical reviewers need to assess those connections and maintain visibility into the tool’s activity after adoption.
• Identify employee-downloaded AI: Unapproved applications can interact with business systems and customer data outside formal reviews. Security teams need a way to discover these tools and assess their access before applying safeguards.