As artificial intelligence aka Super Intelligence, as per our Honorable US President Donald Trump continues to become deeply integrated into enterprise environments, AI agents are increasingly being trusted to perform tasks, access information, and make decisions on behalf of employees.
However, a new study highlights a growing gap between the policies companies have established for AI agents and the way those controls are actually implemented in practice.
Over the past few years, concerns surrounding AI agents have grown significantly, particularly after instances where autonomous AI systems have been reported to behave unexpectedly or perform actions that could create Cybersecurity risks. While organizations are putting policies in place to control these systems, the latest findings suggest that simply having a policy does not necessarily mean that AI agents are being effectively restricted.
Delinea’s 2026 Identity Security Report: The AI Enforcement Gap highlights this growing concern. The report indicates that organizations are struggling to translate their AI security policies into effective technical controls. As a result, AI agents may continue to have access to company networks, applications, and sensitive data even when that access is no longer necessary for the task they were originally assigned.
One of the most concerning aspects of the findings is the gap between what organizations believe they have implemented and what is actually happening within their environments. According to the report, 99.7% of IT and security leaders said their organizations have a formal policy governing what data AI agents can access and how those agents should be isolated from sensitive information that they do not require.
However, having a formal policy is only the first step. Organizations also need to ensure that those policies are technically enforced. If an AI agent is granted excessive permissions, it could potentially access information beyond its intended scope or take actions on behalf of users without sufficient oversight.
This becomes particularly important as AI agents move beyond simple Chatbot functions and begin interacting directly with enterprise systems. An agent may be permitted to access databases, internal applications, cloud platforms, emails, or other business resources to complete a task. If those permissions are not carefully managed, an agent could unintentionally expose sensitive information or perform actions that create security and compliance risks.
The issue therefore extends beyond whether organizations trust AI. It is increasingly about how organizations control the identities and permissions associated with AI agents. Just as human users are subject to access controls and authentication requirements, AI agents also need clearly defined permissions, continuous monitoring, and restrictions based on the principle of least privilege.
The findings from Delinea suggest that enterprises may need to move from simply creating AI governance policies to actively enforcing them. As AI agents become more autonomous and increasingly integrated into business operations, ensuring that they only have access to the information and systems they genuinely need will become an important part of enterprise Cybersecurity.
