AI and the Enterprise Risk - Part 3
Part 3 of 3: Authorization and Governance
The final decision is perhaps the most consequential one. An enterprise may determine that AI provides substantial value. It may select an appropriate model architecture. It may establish contractual protections, security controls, data policies, and technical safeguards.
It must still decide what the AI is permitted to access and what it is permitted to do.
That decision becomes substantially more important when the AI system is an agent.
A conventional software application generally performs functions that developers explicitly define. An agent can interpret objectives, select among available tools, retrieve information, generate intermediate reasoning, and initiate actions according to its assigned authority.
The enterprise therefore faces a new governance question:
What level of authority should be delegated to a non-human system that can interpret instructions and act upon enterprise resources?
Authorization should begin with purpose
AI authorization should begin with the business purpose rather than the capabilities of the model.
An enterprise should first establish what the system is intended to accomplish.
That sounds obvious, but it creates an important boundary.
An agent designed to summarize internal documents does not inherently require access to customer databases.
An agent designed to identify sales opportunities may require customer information but not access to payroll.
An engineering agent may need source-code access but not authority to modify production infrastructure.
The question should therefore be:
What minimum information and authority are necessary to accomplish the defined objective?
This is essentially least privilege applied to AI. The principle itself is familiar. What changes is the entity receiving the privilege.
Agents complicate traditional access control
Traditional identity and access management is designed around people, applications, services, and defined permissions.
Agents introduce an additional layer.
The agent may have an identity, but its behavior is generated dynamically. It may determine which tool to invoke, what information to retrieve, and what action to perform based upon the context it receives.
This creates a distinction between technical permission and intended authority.
An agent may technically be permitted to perform an action that the enterprise never intended it to perform in a particular circumstance.
That is one reason excessive agency has emerged as a significant AI security concern. OWASP identifies excessive agency as a risk when an LLM-based system is given excessive functionality, permissions, or autonomy.
The problem is not necessarily malicious behavior by the model.
The system may simply have been given more authority than its designers should have granted.
The problem of indirect instructions
Agentic systems also create a particularly unusual authorization problem because the agent may consume information that contains instructions.
A traditional application generally distinguishes between data and executable instructions.
An LLM does not inherently make that distinction in the same way.
A document retrieved by an agent might contain text instructing the model to perform some action. A webpage might contain malicious instructions. An email might contain language designed to manipulate the agent.
This is the problem commonly described as prompt injection.
OWASP notes that prompt injection can result in sensitive-information disclosure, unauthorized access to functions, arbitrary commands, and manipulation of decision-making processes.
This creates a fundamental governance issue:
Should information retrieved by an agent ever be capable of changing what the agent is authorized to do?
In a well-designed architecture, the answer should generally be constrained by controls outside the model itself.
The model should not be the final authority determining its own permissions.
The model should not be the security boundary
One of the most important principles in enterprise AI governance is that instructions given to the model should not substitute for conventional authorization mechanisms.
Telling a model, "Never reveal confidential information," is not equivalent to enforcing a technical access-control policy.
OWASP specifically cautions that system prompts should not be treated as security controls and that sensitive credentials or authorization mechanisms should not be embedded in prompts.
The distinction is fundamental.
The model can interpret policy.
It should not be solely responsible for enforcing policy.
If an employee is not authorized to access a particular database, the system should prevent the employee's AI agent from retrieving it rather than relying upon the model to remember that it should not.
Likewise, if an agent should not be capable of transferring customer information outside an approved environment, that restriction should exist in the surrounding architecture.
Data classification becomes AI authorization
Traditional data classification often produces categories such as public, internal, confidential, and restricted.
AI makes those classifications operational.
The enterprise should be able to map information classifications to AI permissions.
For example, public information may be available to broadly deployed AI systems.
Internal information may require enterprise-controlled models.
Confidential information may require additional technical restrictions.
Highly sensitive trade secrets may be prohibited from certain AI environments altogether.
Customer information may require controls dictated by contractual, regulatory, or privacy obligations.
The exact categories will differ between organizations. The principle does not.
The sensitivity of information should influence the authority of the AI system permitted to process it.
NIST's Generative AI Profile recommends policies concerning collection, retention, data quality, third-party intellectual property, training data, and sensitive information exposure.
Customer data introduces a separate obligation
Enterprise AI governance becomes more complicated when the information does not belong exclusively to the enterprise.
Customer data may be held by an organization but remain subject to contractual restrictions, privacy obligations, industry requirements, or other legal constraints.
The enterprise therefore cannot simply determine that a particular AI application is safe for its own proprietary information.
It must also determine whether it has the authority to process other parties' information in that environment.
This distinction becomes particularly important when agents can combine information from multiple sources.
An agent might have access to an internal customer record, a contract repository, an email system, and an external knowledge source.
Each individual access may appear legitimate.
The combined result may nevertheless produce information that should never have been assembled or disclosed.
This is one reason AI governance cannot focus solely on individual databases.
It must consider what the AI can infer by combining authorized information.
The problem of emergent access
An enterprise may carefully restrict direct access while inadvertently creating broad effective access through an AI system.
Suppose an employee can access only a subset of corporate information.
An AI assistant connected to multiple repositories might be able to retrieve information from each repository and summarize the combined result.
The employee has not technically received direct database privileges.
But the AI may have effectively created a new information-access layer.
That creates a critical governance question:
Does AI access need to be evaluated according to the permissions of the user, the permissions of the agent, or the intersection of both?
In many environments, the safest architecture will require the agent's authority to remain bounded by the requesting user's authority, while also imposing additional restrictions based upon the nature of the action.
This is an architectural issue, not merely a policy statement.
Human oversight is not a universal solution
Human approval is often proposed as the answer to agentic risk. It can be useful, particularly for high-impact actions. But "human in the loop" does not automatically produce meaningful control.
A person who approves hundreds of AI-generated actions per day may become a rubber stamp.
A reviewer may not have sufficient context to understand what the agent actually did.
An agent may present a recommendation without exposing all of the information that influenced it.
The quality of oversight therefore matters more than its existence.
Human authorization should be concentrated where human judgment materially reduces risk rather than being added ceremonially to every workflow.
Authorization should be proportional to consequence
A useful enterprise framework is to consider four dimensions:
- Information sensitivity. What information can the system access?
- Action authority. What can the system change, transmit, purchase, delete, approve, or otherwise execute?
- Autonomy. How independently can it select actions?
- Consequence. What happens if the system makes a mistake or is manipulated?
An agent that reads public information and drafts an internal summary has a very different risk profile from one that can modify customer accounts, transfer funds, change production systems, or disclose confidential information.
The second system should require substantially greater governance.
This seems obvious when stated plainly. Yet the rapid development of agentic AI creates pressure to grant systems broad access because broad access often produces better demonstrations and greater automation.
The enterprise should resist confusing maximum capability with appropriate capability.
The authorization decision
The final authorization decision can therefore be expressed conceptually as a sequence:
What is the business purpose?
- What information is required?
- How sensitive is that information?
- What model and architecture will process it?
- Who owns and controls the relevant components?
- What actions are required?
- What permissions are technically necessary?
- What could happen if the agent behaves incorrectly or is manipulated?
- What independent controls exist outside the model?
- What residual risk remains?
- Authorize, restrict, redesign, or decline.
The last option is important. A mature AI governance program must permit the answer to be no.
Not every technically feasible AI application is economically justified once information risk, security, legal exposure, operational dependency, and potential consequences are considered.
Governance must remain dynamic
Authorization should not necessarily be permanent. AI systems change.
Models are updated. Tools change. data sources expand. Agents acquire new capabilities. Organizations modify workflows. Vendors change infrastructure and policies.
An agent that was appropriately authorized six months ago may have materially different capabilities today.
NIST's AI Risk Management Framework emphasizes lifecycle-based risk management rather than treating AI evaluation as a one-time activity.
That principle becomes especially important for agentic systems.
Authorization should therefore be capable of being revisited when the model, data, tools, permissions, or business purpose changes.
The larger enterprise question
The central issue is ultimately not whether enterprises should trust AI. Trust is too broad a concept to be operationally useful by itself.
The more useful question is:
What specific authority is the enterprise willing to delegate, under what conditions, to which AI architecture, over which information, and with what ability to revoke that authority?
That framing changes the conversation.
It moves AI governance away from generalized optimism or generalized fear and toward measurable enterprise decisions.
Commercial AI may be appropriate for some information.
Private models may be appropriate for others.
Proprietary models may be justified in circumstances where control, differentiation, or dependency concerns outweigh their cost and complexity.
Agents may be appropriate for certain workflows while remaining unsuitable for others.
The objective is not to eliminate risk. That would be impossible. The objective is to understand which risks the enterprise is accepting, why it is accepting them, and whether the business value justifies them.
The most consequential AI governance decision may therefore occur before the first prompt is entered and before the first agent is deployed.
It occurs when an enterprise decides that a particular AI system has earned the right to know something—and perhaps eventually to do something—that previously belonged exclusively to people and systems under its direct control. That decision deserves the same rigor traditionally applied to other major enterprise-risk decisions.
Because once authority has been delegated, the question is no longer whether the enterprise trusts AI. The question is whether it has retained enough control to remain accountable for what that trust makes possible.
Article published by icrunchdata
Image credit by Getty Images, Moment, Eugene Mymrin