AI agents are moving quickly from experimental tools to operational actors inside enterprise systems. No longer confined to chat windows, they can query databases, modify configurations, trigger workflows, and interact with other systems. As their autonomy expands, the confidence of senior technology leaders has not kept pace. An IBM survey of 2,000 C-level executives found that only 11% feel fully prepared for the scale of AI-agent deployment expected in the coming year. Two-thirds of CIOs and CTOs say they are accountable for AI systems they do not fully control, and 70% report that teams are deploying technology faster than IT can track. IBM described the findings as evidence of a growing control gap as AI use expands across business operations.
The Control Gap in Enterprise AI
The control gap is not simply a security issue. It is a governance issue. Organizations are giving AI systems the ability to take actions that have real consequences, but many do not have the visibility needed to understand what the systems are doing or why. The gap exists at multiple levels: technical, operational, and organizational. There may be logs, but they are often fragmented. There may be permissions, but they are often broad. There may be model governance, but it rarely extends to the tools and data an agent can access. This makes it difficult to answer basic questions: What did the agent do? Why did it do it? Who authorized it? What happened afterward?
Madhuri Chandoor, founder of PromptHalo, an AI security and trust infrastructure company, argues that the central issue is not the technical capability of AI agents. It is whether those capabilities are matched by clearly defined authority. Chandoor says PromptHalo focuses on why an action is being performed, not only what is being performed. The company works to inspect the reasoning and context behind actions, giving organizations more information about user intent, assigned permissions, and surrounding circumstances before the system proceeds. In her view, an agent can have the technical ability to perform an action, but that does not mean it should be allowed to perform it in every context.
Capability vs Authority
The distinction matters because an agent can appear technically correct in a narrow sense while still causing harmful downstream effects. Chandoor gives the example of an infrastructure-managing AI agent asked to improve application performance. The agent might add or remove an index, or change table structures autonomously in a production environment. Within its narrow focus, the action might look logical. But in a live environment, this action could affect transactions, customer data, or dependent processes that the agent did not analyze. “A technical conclusion can appear reasonable within a narrow focus,” Chandoor says. “The context, the situation, and the downstream impact still need to be considered before an action proceeds.”
This is a significant shift from earlier chatbot systems. In Chandoor’s account, previous chatbots generally operated within a predetermined set of questions and answers. They had limited ability to influence systems outside their immediate conversational scope. With large language models, companies are using broader company information and tools, which increases the exposed risk surface. Businesses now have to consider how incoming requests could influence a system. Chandoor recommends that security teams examine how a request is interpreted and what level of authority connected systems provide before an agent proceeds.
When Small Actions Add Up
One of the clearest illustrations of the issue is the refund scenario. In her example, an agent can issue refunds up to $50 without human review. A user then requests ten $50 refunds rather than one $500 refund that would require review. Each individual transaction appears permitted under the rule. But the sequence suggests an attempt to avoid the threshold. Chandoor says reviewing broader session context and behavior can help identify when escalation for human review may be appropriate. The example shows why per-action limits are not sufficient. Agents need context-aware controls that assess the entire interaction, not just each individual step.
This type of situation is common in traditional fraud detection. A single transaction may not look suspicious, but a pattern of transactions can reveal something meaningful. The same principle applies to AI agents. Behavioral context provides a fuller picture of what is actually happening. It helps distinguish between a legitimate series of actions and an attempt to game the system. Without that context, controls can be bypassed in simple and predictable ways.
Behavioral Profiling for AI Agents
Drawing on two decades in financial services, Chandoor compares her approach to fraud monitoring across transactions and accounts. Financial institutions do not simply check whether a single transaction is within a limit. They look at patterns, anomalies, and behavior over time. She suggests organizations develop behavioral profiles for autonomous agents alongside identity and access permissions. Under her proposed model, teams would review the resources an agent accesses, its use of tools, changes in activity over time, and actions that appear inconsistent with its assigned role or the circumstances of a session.
Behavioral profiling is a useful concept for AI governance. Traditional identity and access management controls establish what an agent is allowed to touch. But they do not always reveal whether an agent is behaving appropriately in context. An agent might have permission to read a database, but should it be reading thousands of records in a single session? Should it be running the same query repeated many times? Should it be changing a configuration at a certain hour of day? These are the kinds of questions that behavioral monitoring can help answer.
The challenge for organizations is that AI agents can act at machine speed. By the time a human reviews a log, the impact may already have occurred. This makes it necessary to build control points into the design of agentic systems, not just to rely on post hoc analysis. Chandoor says teams benefit from documenting the resources an agent may access, the conditions that apply to that access, and the possible downstream effects of particular actions. This documentation becomes the basis for meaningful authorization decisions.
Design-Time and Runtime Controls
Questions about authorization should be considered during both design and operation. At design time, teams need to define the scope of an agent’s role. What data can it see? What tools can it use? Under what conditions is it allowed to take a particular action? What are the potential consequences of that action? Without clear answers to these questions, an agent may have implicit authority far beyond what its task requires.
At runtime, Chandoor recommends observability gates. These are checkpoints where activity is reviewed, especially when requests become repeated, unusually broad, or inconsistent with the purpose originally assigned to the agent. Observability gates can help contain the impact of an errant agent and determine what additional controls are required to secure underlying systems. They are a way to put verification into the workflow rather than assuming that a model’s behavior will remain stable over time.
Another important aspect is accountability. Chandoor emphasizes that AI security cannot be an afterthought. It must be operationalized with clear accountability ownership across the organization. This means assigning responsibility for AI application security, not just for the model output but for the actions taken by the agent. It also means ensuring that the people accountable for AI systems have visibility into how those systems are being used and changed.
The issue of accountability is especially pressing given the IBM findings. If CIOs and CTOs believe they are accountable for AI systems they do not fully control, then something has to change in the way these systems are governed. The survey suggests that many organizations are in a reactive mode, scrambling to understand AI deployments after the fact. Chandoor’s approach argues for a more proactive stance, one in which the authority of an agent is defined by context and verified through behavior.
Trust, But Verify
Chandoor says she supports responsible AI adoption. She favors using agentic automation for analysis and workflows, but applying additional verification when the impact involves critical decisions and actions. “Trust, but verify,” she says. “Businesses should adopt AI responsibly and verify its behavior throughout the process. Establishing clear accountability ownership across the organizations for AI applications security is essential to operationalise these guardrails.”
In her view, this approach can allow companies to pursue AI innovation while giving security and accountability the attention they need. The era of AI agents may require less faith in model intelligence and more discipline in system design. The technology can perform a wide range of tasks, but that does not mean it should be given unlimited authority. The limits need to be clear, observable, and enforceable.
This is not a rejection of AI agents. On the contrary, it is a call for maturity in their deployment. Agents can bring enormous value to enterprise operations when they are used within well-defined boundaries. The challenge for business leaders is to define those boundaries as carefully as they define the capabilities. What resources can the agent access? Under what conditions? How will unusual behavior be detected? Who will be accountable when an agent causes damage? These are the questions that need to be answered before an agent is authorized to act.
As AI continues to evolve, the question will not only be what AI can do, but also what it should be allowed to do. The distinction between capability and authority offers a practical starting point. For companies looking to close the control gap, the work begins with context. They must understand the intent behind each request, the permissions attached to it, and the full range of effects that an action can trigger. That context must then be embedded into the systems that govern AI agents, so that verification is not an afterthought but a continuous part of the process.