Say your agent just sent an email your CISO didn't authorize. Was that a bug, or was it working as designed? The fact that it's genuinely hard to answer is why “AI at work” and “agentic AI” aren't the same conversation.
A copilot suggests things and waits for you. An agent decides and then acts on its own. Once you cross that line, the old review-and-approve way of doing security stops working, because there's often nobody in the room to review anything. You need to keep checking what the agent is actually trying to do, since the threat isn't always someone breaking in from outside. Sometimes it's your own agent slowly drifting away from the job you gave it.
That drift has a name
We call it semantic privilege escalation. The agent never leaves its permission envelope. It just starts operating outside its intended purpose, maybe because of a prompt injection, maybe through a chain of reasonable-sounding inferences, maybe because of poisoned context sitting in its memory. Everything it does is technically allowed, and that's exactly what makes it dangerous.
These aren't rare edge cases either. They're failure modes baked into how most agents are being set up right now, across email, documents, CRMs, code and cloud accounts, running on real delegated credentials around the clock with nobody watching.
Pulling back access isn't the answer
Access is the whole point. If your response to this risk is to strip agents of the access that makes them useful, you've solved the security problem by deleting the business case.
What you actually need is agent integrity. That means keeping three things lined up and provable: what the agent can do, what it should do, and what it actually does. Across every tool call, every session, every handoff.
Our bet is that the winners of the agentic era won't be the companies that deployed fastest. They'll be the ones who can show a defensible audit trail when something goes sideways, and still ship on time.