In 2025, attackers reached the Salesforce data of hundreds of companies without breaking into Salesforce. They used access tokens belonging to an AI chat agent. Google's threat intelligence team counted more than 700 potentially affected organizations, and because the tokens belonged to a trusted app, they carried the attackers past safeguards such as MFA.
Enterprises already know how to manage this kind of risk for people. A delegation of authority defines who can sign a contract, approve a payment, or commit spend, up to what limit, and with whose sign-off. A new manager gets a ceiling. A large deal goes to the board. Speed and usefulness never earn anyone unlimited authority.
AI agents now hold authority of the same kind. They update records, send messages, call APIs, and trigger workflows. Most received that authority informally, through a service account, a connector, or a user's inherited permissions, and nobody set a limit.
How Much Authority Do AI Agents Hold Today?
More than most leaders assume. In a Salt Security survey of more than 380 organizations published in October 2026, 49.8% confirmed or suspected that an AI agent had taken an unintended, unexpected, or unauthorized action in the past year. Only 12.5% could reliably follow an agent's activity from instruction to result.
The volume is about to change by orders of magnitude. Gartner expects the average Global Fortune 500 enterprise to run more than 150,000 agents by 2028, up from fewer than 15 in 2025, while only 13% of organizations believe their agent governance is adequate. At that scale, every informal grant becomes a standing approval that nobody owns.
Why Can't Access Controls Alone Set an Agent's Limits?
Access control answers whether an identity can reach a system. A delegation of authority answers how much it can do there, under what conditions, and on whose behalf. Agents need that second answer because what they read shapes what they do.
EchoLeak, disclosed in June 2025, showed the mechanism. A crafted email, pulled into Microsoft 365 Copilot as routine context, could direct the assistant to leak internal data with zero clicks. Microsoft fixed the flaw, rated CVSS 9.3, and reported no evidence of exploitation. The principle applies to every agent: legitimate access can be steered toward an illegitimate action.
Chaining raises the stakes. In the Salt Security survey, 76.8% of respondents reported agents that invoke other agents, tools, and APIs, so one instruction can travel several hops before it changes a system. The OWASP Top 10 for Agentic Applications now lists tool misuse, privilege abuse, memory poisoning, and cascading failures among the leading agent risks.
What Belongs in an AI Agent's Delegation of Authority?
A useful delegation describes what an agent can do, which depends on far more than the model behind it. Two agents on the same model can carry very different exposure. Each agent's charter should define four things:
- Identity: the principal the agent acts as, and whether it inherits a user's broader privileges.
- Tool reach: the systems it can invoke, from email and CRM to databases and payment flows.
- Action scope: the records it can change, with limits on value and volume, and whether it can delete or delegate.
- Context path: the inputs it is allowed to trust, including documents, messages, memory, and peer agents.
How Should Agent Authority Scale With Business Consequence?
The same way approval limits scale for people. Low-consequence work runs freely; high-consequence work needs a signature.
- Read and analyze: retrieval only, within data policy.
- Draft and recommend: the agent prepares the action and a person executes it.
- Act within limits: writes are scoped to purpose, capped, logged, and reversible.
- High-impact actions: financial, customer-facing, security, or regulatory changes require human approval.
Two disciplines carry over directly from finance. Every grant has an owner and a review date, so authority cannot accumulate unseen. Reversibility comes before write access, with rollback paths and transaction limits that let operations teams contain an error.
How Do You Keep Agent Authority From Drifting?
A delegation is only as strong as its enforcement. Agents drift as integrations change and teams connect new systems, yet only 17.5% of organizations can automatically contain a misbehaving agent. Security teams should log every tool call against the agent's identity and triggering input, compare live permissions with the approved charter whenever roles change, and flag unusual write volume or new destinations. Human overrides deserve the same attention, because each one marks a limit that needs redesign.
How Does iOPEX Build Security Into Agentic Execution?
At iOPEX, we design Agents for bounded enterprise workflows where autonomous execution stays auditable and subject to oversight. Human checkpoints, performance and safety testing, and controlled cross-system orchestration sit inside the operating model.
Through our Data & AI capabilities, we apply policy-aware access, masking, redaction, lineage, and audit evidence across enterprise data and AI workflows. Our platform architecture adds runtime security, audit logging, and performance monitoring as agents coordinate actions across systems.
Approval limits are what allow a CFO to delegate large commitments with confidence, because accountability is clear at every level. Agent authority follows the same logic. The enterprises that define it explicitly will be able to extend it furthest. Connect with our team to set the limits before your agents set them for you.
