AI agents keep access to company data after their work is done
IT teams responsible for identity security are concerned about AI agents’ ongoing access to company systems and the actions they take on users’ behalf, according to a Delinea’s 2026 Identity Security Report: The AI Enforcement Gap.
“Written policy is only as good as your ability to enforce it at the moment an AI agent acts,” said Art Gilliland, CEO of Delinea. “Our research echoes what I hear from leaders constantly: they have the AI policies in place, but they can’t see or report on what their agents actually do.”
Type of data accessed by AI tools and agents Source: Delinea)
Gaps in AI policy enforcement
99.7% of IT and security leaders said their organizations had a formal policy governing the data AI tools and agents could access. They also reported or suspected that an AI tool or agent had accessed sensitive data beyond what its task required in the past year.
Fifty-seven percent said policies were documented and enforced well enough for them to understand what data AI tools were permitted to access. About 51% of organizations check AI access against policy in real time, and fewer than one in five detected the most recent instance of access outside an agent’s intended scope as it happened.
Sixty percent of employees said they had felt pressured at work to use AI tools with sensitive or confidential information without knowing whether it was permitted. When business demands or deadlines require faster use of AI than governance processes allow, some employees do not know which steps to follow.
Most employees know formal approval is required to access company data, applications or systems through AI tools. Seventy-six percent said they had bypassed approval at some point to use these tools on work systems.
AI agents keep access after tasks end
Companies give AI agents permissions that remain active after their work ends. This ongoing access allows tools to continue reaching company systems and data until permissions expire or someone revokes them.
Business teams and employees sometimes grant access without IT or security approval. Tools may connect through a user’s work account, or employees may set up connections themselves. The data these tools access includes customer records, employee information, financial data, security logs and source code.
Some organizations revoke permissions on a schedule or leave credentials active until an audit. Others rely on employees to disconnect tools. Forty-two percent of IT and security leaders said their organizations had no automatic way to remove AI access when a session ended.
Agents can inherit the permissions of the person who launches them. IT leaders reported using a user’s existing permissions to limit an agent’s access. These permissions may include privileges the employee accumulated over years, giving the agent access unrelated to its assignment.
An agent can select tools and take a sequence of actions to reach a goal. Broad permissions allow it to take steps that were not anticipated when access was approved. Unintended actions can cause damage.
Security teams have limited visibility into AI actions
Many organizations have limited visibility into what agents do after they connect. Monitoring may cover only some tools, leaving individual actions unchecked.
Software build and deployment pipelines and Kubernetes environments had the lowest reported levels of enforcement at the moment of action across the systems surveyed. Coding agents operating in these environments may be able to change applications and infrastructure.
Respondents often reported taking a day or longer to detect the most recent instance of an AI tool or agent accessing data outside its intended scope. During that period, an agent may continue selecting tools and taking actions without human input.
Some organizations can revoke credentials immediately and need additional time to end an agent’s session. An active session may allow the tool to continue operating, making session termination part of the response to unauthorized access.
AI access is difficult to trace
Only 36% of IT respondents said they could always trace an AI access event involving sensitive data to the person who authorized it.
Limited traceability makes it harder to establish why access was granted, what conditions applied and who was responsible for the decision. These details help organizations investigate incidents and demonstrate that security rules were followed.
Employees reported uncertainty about which information was sensitive, whether their AI tools could access it and who would be accountable for improper use. Many did not know whether someone could stop a tool from accessing sensitive data.
Some employees who had seen an AI tool access more information than expected never reported it. Unreported incidents leave security teams without information that could help them identify and address unauthorized activity.
