Gartner’s September 30, 2026 note says an AI system does not need general intelligence to create cyber risk. It needs a way to affect operations. In a second-quarter 2026 survey of 297 cybersecurity leaders, 54% of organizations had no defined approach to limit AI-agent access, or relied on access already defined for a person.
The fact
Treat that 54% as a description of a default, not as a score you must beat for its own sake. The default is: the integration user, the service account, or the employee who clicked connect. Gartner’s recommended shift is to govern by action privileges, and to constrain how far a workflow can go.
The list
| Write this down | A bad answer |
|---|---|
| Whose identity the agent uses | “The admin who set it up” |
| Which systems it can read | “Whatever the connector allows” |
| Which systems it can change | “Same as the user” |
| What it cannot do without a person | “It will ask if it is unsure” |
| Who can turn it off tonight | “The vendor” |
If the agent can send mail, move money, open a ticket, or change a record, those are separate lines. “It only helps” is not a line.
FAQ
Is inheriting a human’s access ever acceptable?
Only if you would give that same person a second unattended session with the same rights, overnight, with no manager in the room. Most “same as the user” designs fail that test.
Do we need a new product to start?
No. Start with the identity the workflow already uses. A tool can come later. A nameless service account is the current risk.