When enterprise security teams attempt to bring order to autonomous AI, their first instinct is almost always administrative: Assign a named owner to every agent.
That logic appears straightforward on the surface. If every automated script, coding assistant, and workflow agent is tied to a specific human operator, the enterprise creates a clear line of accountability. When a system misbehaves, attempts an unapproved data call, or queries a restricted internal directory, security personnel know exactly whose door to knock on.
However, new research surveying 251 cybersecurity leaders — conducted by Zentera and independent research agency TrendCandy — reveals that this ownership-first strategy is already buckling under the weight of real-world enterprise deployment.
Eighty-five percent acknowledge running more AI agents than approved human owners, and 81 percent admit that internal disputes over agent ownership are actively delaying critical governance decisions.
Relying on human ownership as your primary defensive barrier fundamentally misunderstands how autonomous software operates. Assigning an owner provides helpful context after an incident occurs. It does nothing to prevent an autonomous agent from crossing project lines, pulling unauthorized code, or exposing sensitive corporate data in real time.
The Illusion of Post-Incident Attribution
Human employees operate within a well-understood social, professional, and policy framework. A human worker understands implied boundaries, operational consequences, and corporate policy compliance.
Autonomous AI agents possess no such internal compass. They are goal-oriented systems. When prompted to complete a task, an agent determines its own execution path along whichever data corridors are open, operating at machine speed across internal subnets.
Consider a scenario where an engineering agent runs a broad semantic search to resolve a software bug. In doing so, it traverses a flat network and pulls proprietaryclient. Security logs will successfully trace that agent back to the developer who initiated the prompt
Path attribution is simple, but what does that accountability actually achieve after the fact? The developer never instructed the agent to cross project lines or violate a non-disclosure agreement. Disciplinary action against the human owner is meaningless because the operator did not request the rogue behavior.
Tracking ownership after data has been exposed is a post-mortem exercise. It answers who launched the process, but it fails to stop the action before damage occurs.
The Right Task in the Wrong Place
The defining risk facing enterprise AI today is not that agents perform the wrong task, but that they perform a technically correct task in the wrong environment or location. In our study, 75 percent of security leaders cited this “wrong place” scenario as their primary operational concern, while 84 percent noted that agents cross project boundaries far more easily than human employees.
This risk is compounded by the rapid spread of unsanctioned or “shadow” AI. Agents rarely enter an enterprise through central IT provisioning queues. Instead, they are introducednd vendor software updates
Eighty percent of survey respondents worry that agents in their environment hold access permissions that were never explicitly granted. Because legacy network models enforce security at the server or IP address level, an agent running inside a trusted host inherits that machine’s broad access rights by default.
When an unmapped shadow agent appears, it operates entirely outside of your identity registry. If your security posture relies on verifying approved owners before enforcing controls, an unassigned agent will navigate your network unhindered.
Enforcing Boundaries Outside the Agent
To build sustainable trust in enterprise AI, organizations must shift from human attribution to environmental containment. Instead of relying on post-incident discipline or hoping agents adhere to system prompts, security architectures must enforce explicit, software-defined boundaries that agents cannot cross—regardless of their instructions, owner, or intent.
Achieving this level of environmental control requires three practical capabilities:
- Process-level discovery: Security teams must look beneath the server host layer. Auditing execution logs allows teams to detect unauthorized local process spawns, unapproved Python binaries, and hidden background routines communicating with external model context protocol (MCP) servers or unvetted model endpoints.
- Explicit authorization over inherited permissions: Decouple permissions from the host appliance and assign them directly to the individual application process. Fifty-six percent of survey respondents ranked explicit authorization as the single most important control required before scaling AI fleets.
- Project enclaves and environmental isolation: High-tech enterprises frequently manage sensitive multi-tenant workloads on shared infrastructure. By wrapping project environments in software-defined enclaves, organizations isolate workloads into protected virtual chambers. If an agent attempts an unauthorized cross-boundary request, the network isolates the process instantly without interrupting adjacent human workflows.
Seventy-nine percent of security leaders expect their organization will need to claw back or restrict AI agent usage within the next 18 months due to governance gaps.
Dr. Jaushin Lee is the founder and CEO of Zentera Systems. He is a serial entrepreneur with many patents. He is also the visionary architect behind CoIP® Platform, Zentera’s award-winning Zero Trust Fabric. Jaushin has over 20 years of management and executive experience in networking and computer engineering through his experience with Cisco Systems, SGI, and Imera Systems.
