For the last two years, companies have been asking employees the same question:
Are you using AI at work?
Very soon, that question may sound outdated.
The more important question will be:
What is your AI allowed to do?
Because the next phase of enterprise AI is not simply about employees opening a chatbot, typing a prompt and receiving an answer.
AI agents can increasingly search systems, analyse information, create documents, communicate with other tools, trigger workflows and perform multi-step tasks with less human intervention.
They are moving from answering questions to taking action.
And the moment AI can act inside an organisation, it stops being only a productivity conversation.
It becomes an identity, access, cybersecurity and governance conversation.
The chatbot era was the easy part.
A chatbot sits on one side of the screen.
You ask.
It answers.
An AI agent can be very different.
Imagine an agent whose job is to prepare a weekly sales report.
To do that properly, it might need access to:
It may collect information from several systems, analyse it, create a presentation, send it to management and schedule the next review.
That is no longer simply a clever piece of software producing text.
That is something operating inside your digital organisation.
And that leads to an uncomfortable question:
If an AI agent can access company systems, retrieve sensitive information and perform actions, should we start managing it more like a digital employee than a software feature?
Not because an agent is a person.
But because from a security perspective, it may increasingly possess something very employee-like:
access.
Every AI agent eventually runs into the identity question.
Cybersecurity has spent decades learning one fundamental lesson:
Access should never be assumed. It should be controlled.
Who are you?
What are you allowed to access?
What are you allowed to change?
For how long?
On whose behalf?
And can we prove afterwards what you did?
Those questions underpin modern identity and access management.
Now they need to be asked about AI agents too.
NIST has made this issue explicit. Its 2026 work on agentic AI highlights the need for strong identification and authorisation controls when agents interact with organisational data, applications and tools. NIST has also raised questions around auditing agent activity, authority, non-repudiation and protection against attacks such as prompt injection.
This means one of the biggest enterprise AI challenges may not ultimately be:
“How intelligent is the model?”
It may be:
“What authority did we give it?”
The rise of the invisible workforce
There is another complication.
Central IT may not even know every agent exists.
Employees can increasingly build their own automations, workflows and AI agents using low-code tools, enterprise platforms and AI-assisted development.
That is incredibly powerful.
It is also the beginning of what Gartner describes as shadow AI agents: agents created, embedded or consumed outside traditional governance structures, sometimes without cybersecurity teams having sufficient visibility or control.
We have seen this movie before.
First there was shadow IT.
Employees subscribed to cloud software without IT approval because it solved their problem faster.
Then came shadow data, as information moved across SaaS platforms and personal productivity tools.
Now we may be entering the era of shadow automation.
Except this time the tool does not simply store information.
It may act on it.
Imagine this scenario.
A marketing manager creates an AI agent to speed up campaign reporting.
Initially, the agent only reads analytics data.
Then someone connects it to the CRM.
Then to customer email histories.
Then to a shared drive containing commercial proposals.
Then the team gives it permission to draft communications.
Then someone adds an automation so that certain communications are sent automatically.
Nothing in that sequence necessarily feels dramatic.
Each step may even be perfectly reasonable.
But six months later, ask the organisation:
Exactly what can this agent access?
Who owns it?
Who approved those permissions?
What happens if its creator leaves the company?
Does it still need every permission it was originally granted?
Are its actions logged?
Could it expose sensitive information?
Could another compromised account instruct it to perform an unintended action?
Suddenly, what looked like productivity becomes governance.
And companies are moving fast.
Microsoft’s 2026 Work Trend Index describes organisations increasingly redesigning work around humans and AI agents rather than simply adding AI tools to existing processes.
In Microsoft’s ecosystem, agent use has reportedly grown 15x year over year overall and 18x in large enterprises. At the same time, Microsoft’s research suggests the biggest determinant of AI impact is not individual enthusiasm but organisational conditions — including leadership, culture, processes and talent systems.
That distinction matters.
Buying AI is easy.
Giving employees access to AI is easy.
Deploying AI agents responsibly across an organisation is something else entirely.
It requires architecture.
It requires governance.
And increasingly, it requires people who understand both the business opportunity and the technical risk.
The most dangerous permission may be the one nobody remembers granting.
Most organisations understand the principle of least privilege for employees.
A junior employee should not automatically have administrator access.
Someone in marketing probably does not need access to payroll data.
A contractor should not retain access six months after the contract ends.
The same logic needs to follow agents.
An agent that only summarises a document probably does not need permission to modify it.
An agent that prepares a report may not need the ability to send external emails.
An agent working for Finance should not silently inherit access to everything its creator can see.
Yet Gartner warns that organisations are already struggling to match agent autonomy with appropriate governance. The firm predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because governance gaps are discovered after production incidents.
That prediction says something important.
The problem will not necessarily be that AI agents fail to work.
The problem may be that they work before organisations have decided how they should be controlled.
This is why “AI literacy” is about to mean something very different.
For a while, AI skills training largely meant:
How to write better prompts.
How to use ChatGPT.
How to generate presentations.
How to summarise documents.
Those skills still matter.
But enterprise AI literacy is rapidly moving up a level.
Professionals will increasingly need to understand concepts such as:
AI governance. Identity and access management. Data classification. Human oversight. Auditability. Cybersecurity. Risk ownership. Responsible automation.
In fact, Microsoft’s 2026 research found that among AI users, quality control of AI output and critical thinking ranked among the most important human skills for working effectively with AI.
The most valuable AI professional in the room may therefore not be the person who knows the cleverest prompt.
It may be the person who knows:
what should be automated, what should not, what the agent should be allowed to access, and where human judgement must remain in control.
The new org chart may include identities that are not human.
For decades, companies designed security around two broad categories:
people and machines.
AI agents blur that distinction.
They can operate like software while behaving more like delegated workers.
They can make decisions based on context.
Use tools.
Access resources.
Initiate actions.
Interact with other agents.
Operate for extended periods.
This is one reason NIST launched an AI Agent Standards Initiative in 2026, focused in part on helping agents interact securely and reliably across digital systems.
The architecture of work is changing.
And security architecture will need to change with it.
Before you deploy your next AI agent, ask seven questions.
1. Who owns this agent?
There should be a human or business function accountable for it.
2. What systems can it access?
Not theoretically. Exactly.
3. What can it do inside those systems?
Read? Create? Modify? Delete? Send?
4. Is its access greater than the task requires?
Least privilege should apply to agents too.
5. Can we see what it has done?
Agent activity should be observable and auditable.
6. What happens when something changes?
Employees leave. Processes change. Data becomes sensitive. Permissions should not live forever.
7. Where does human judgement remain mandatory?
Automation should not silently become authority.
The next AI race will not be won by the company with the most agents.
It will be won by the organisations that know where to use them, how to control them and when not to trust them.
The first wave of enterprise AI was about access.
The second was about adoption.
The next will be about agency.
And agency changes everything.
Because once software can act on behalf of your organisation, cybersecurity can no longer ask only:
“Who has access?”
It also has to ask:
“What has access?”
And perhaps most importantly:
“Who is accountable when it acts?”
The enterprise skills gap is changing too.
As AI becomes embedded into business workflows, organisations will need professionals who can connect technology with governance, cybersecurity, cloud, data and responsible AI practices.
The future of AI training will not simply be about learning how to use AI.
It will be about learning how to deploy it, secure it, govern it and work alongside it responsibly.
Because your next colleague may not need a laptop.
But it will definitely need permissions.