Dr. Jaushin Lee is founder and CEO of Zentera Systems, a leader in zero-trust security solutions for the digitally transformed enterprise.getty​When an organization hires a human contractor, it follows a standard onboarding protocol: It provides a managed laptop, assigns a project and defines clear roles and responsibilities. More importantly, it can rely on a human understanding of consequence: A contractor knows that violating policy leads to termination.​Autonomous AI agents operate without this internal compass. They don’t have an equivalent sense of consequence or judgment.​As enterprises adopt agentic AI to automate complex workflows, they’re introducing a new class of “insider” into sensitive environments. They often operate with extraordinary technical proficiency, yet they’re prone to moments of profound logical failure. They lack the common sense to realize, for example, that modifying large parts of a production database might not be the most efficient way to resolve a minor code conflict.​To maintain security, organizations must elevate AI agents to first-class citizens or risk creating a significant, unmanaged expansion of the corporate insider threat surface. The Autonomy Gap (Or Why Static Rules Fail)Traditional software follows if-then logic, where a specific trigger leads to a predefined result. Agentic AI is goal-oriented. You describe the destination. The agent determines which destination fits your description and decides the path.Yet, because AI operates at machine speed, an agent that goes off the rails—due to naive logic error or a malicious prompt injection—can cause widespread damage before humans can intervene. This is why the industry’s current approach to identity and access management is insufficient for the agentic era.​Process-Level Identity And ControlTraditional access and security controls make decisions at the user, device, server or IP address level. This breaks down when AI agents begin operating as independent processes inside shared environments, originating from singular hosts.​A single workstation, server, container or cloud workload may support multiple agents using different tools, accessing different data and pursuing different objectives. If security teams can only see the host and not the individual AI agent behavior operating within it, they’re forced into sweeping responses: Allow the activity, block the entire host or shut it down.​Agentic AI requires precise control to identify, monitor and restrict each agent based on what it’s doing, where it’s connecting and what data it’s using.The Shadow AI Inventory GapMany AI agents aren’t installed via formal enterprise-level deployment models. Instead, they’re introduced via developer tools, host operating systems, browser-based add-ons, automation scripts and applications. Standard enterprise software is increasingly adding agentic capabilities.​Complete visibility into the type and number of AI agents can be lost. Traditional asset inventory tools may show the endpoint, application or cloud workload but miss the agentic behavior occurring inside it. If security teams can’t detect when software is calling external large language models (LLMs), invoking tools, connecting to model context protocol servers, accessing sensitive repositories or moving data between systems, they lack a reliable inventory of the agents operating in their environment. That turns shadow AI from policy concern into security risk.The Judgment GapHuman employees understand implied boundaries. They know that proprietary code shouldn’t be pasted into a forum, sensitive files shouldn’t be sent to personal accounts and production systems shouldn’t be modified without approval. AI agents with different sources, training and rule sets don’t reliably apply that kind of judgment.​Instead, they pursue the assigned objective using available tools, information and permissions. If those permissions are too broad, an agent can expose sensitive data, disrupt a workflow or alter critical systems while appearing to act correctly.​Your Practical Blueprint For AI GovernanceTo manage risk, enterprises should apply the principles of zero trust where every connection—whether initiated by a human or non-human identity—is continuously authenticated and authorized.​Practical AI governance requires a sandbox approach that manages connectivity without breaking the underlying business process:​Shadow AI Discovery​Security teams should establish high-confidence methods to identify telltale signs of agentic activity on an endpoint. These include:• Auditing process execution logs for agent-like process lineage. AI agents are typically installed per user through package managers and launched from user directories rather than protected system folders. Flag processes that start from user-writable paths and then spawn shells, interpreters or other tools. That spawn pattern is a signature of agentic tool use, not ordinary application behavior.​• Scanning endpoints for agent configuration artifacts. Most agents leave durable traces on disk: MCP server configuration files, IDE extensions with agentic capabilities, local model runtimes and stored API credentials. A periodic scan of these artifacts produces an inventory of agents that network logs alone will miss, including agents that are installed but not currently running.​​• Monitoring outbound connections to LLM APIs and MCP servers. Agents hold long-lived sessions to model provider endpoints and MCP servers. Tying a connection to the specific process that opened it provides a high-confidence signal. Graceful Network ContainmentSecurity teams need a way to contain a suspicious agent without breaking the process around them. Instead of abruptly killing a process or shutting down a host, security teams should be able to restrict the agent’s network access in real time. That means blocking its ability to reach the public internet, sensitive internal systems, lateral movement paths or unauthorized data stores while preserving the stability of the user session. The agent may still exist, but its reach is contained.Proxy-Based Session ControlBy acting as a proxy between the user and the LLM, an AI session controller allows organizations to inject mandatory system-level instructions and enforce policy in real time. These controls can enforce rules such as “never expose PII” or “block file transfers to unauthorized domains.” Integrating with data leak prevention systems can help your teams feel confident that every packet is inspected for sensitive data before it leaves the controlled environment.​The 'Seat Belt' Philosophy: Safety Enables SpeedBusiness leaders often fear that strict security governance will create productivity friction, pushing frustrated employees further into the world of shadow AI. The purpose of these controls isn’t to slow the organization down but to enable it to move faster without losing control.​Consider the seat belts and dividers on a highway: They exist to allow drivers to travel at high speeds safely. Without them, drivers would be forced to travel slower to manage risk.​By following the principles of zero trust, organizations can provide teams with the freedom to experiment with autonomous AI agents, helping ensure that even if an agent discovers a high-risk pathway, the system is designed to prevent it from being able to take it.​​Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?