AI agents are gaining authority to make decisions and take actions that previously required human approval, but many organizations still cannot fully see or audit what those systems do, according to new research from Illumio, a breach-containment platform,.

The report, Licensed to Act: How AI Autonomy Is Outrunning the Limits Placed on It, was released on October 21, and is based on a survey of 1,100 IT and security decision-makers across 10 markets. 

It found that 70% of respondents now delegate decisions or actions to AI that required human approval a year ago, including investigating threats, deploying code and changing access permissions.

Although 84% of security leaders say they have clear visibility into how AI systems reach data and systems, only 49% said they can see and audit every action an AI agent takes.

76% of respondents said their organizations experienced at least one AI-related security issue or warning sign in the past year. 

According to the report, 24% said AI had accessed data it should not have reached, while 26% said an agent or tool had connected to systems without security approval.

AI Access Is Expanding Faster Than Oversight

For Chief Data Officers (CDOs), the findings point to a basic AI governance problem: enterprises are giving AI access to more data and systems without necessarily having equivalent visibility into what agents can reach or what they do with that access.

The challenge grows as agents move beyond recommendations and begin executing tasks. According to the report, 26% of respondents are comfortable allowing AI to grant or revoke access permissions without human review, while 29% are comfortable allowing it to deploy code changes without supervision.

The report also found that 82% believe AI agents require fundamentally different security controls from traditional software. Yet only 25% ranked explicitly defining permitted AI actions among their two main controls.

Governance Needs to Match Agent Authority

For organizations building these safeguards, AI governance guidelines need to address more than model performance. Agent identities, data permissions, audit trails and boundaries on autonomous actions all become part of the governance framework as AI gains operational authority.

The findings are based on a vendor-commissioned survey, so the results should be considered in that context. They nevertheless highlight a growing issue for data and technology leaders: the ability to grant an AI agent access is developing faster than the ability to demonstrate exactly how that access is being used.