Shashwat Sehgal is CEO and co-founder of P0 Security, helping enterprises secure runtime access across agents and users before risk happens.gettyThe move from generative AI to agentic AI changes more than the technology. It changes where business risk actually shows up.When I talk with security leaders, I keep hearing some version of the same question: We have controls around the models, prompts and data. What happens when the agent leaves that environment and starts doing work across the business? THAT is the right question.With generative AI, security teams could focus most of their attention on model interactions—what went into the prompt, which model saw it and what came back. Agents don't stop there. They call tools, query databases, reach into SaaS applications, touch cloud resources and trigger business workflows. The most consequential thing an agent does often happens afterward, when it uses enterprise access to take action.AI gateways are a real and useful control for model traffic—routing, logging, rate limits, prompt inspection, data controls. But they don't answer the harder question: Should this agent, acting on behalf of this person or system, be allowed to take this action on this resource right now?That's not purely an AI security question. It's an identity and authorization question.The Agent's Identity Is Only Part Of The PictureThere's an assumption security teams need to push back on: that giving every agent an identity solves the problem. It doesn't.Knowing which agent is acting doesn't tell you who kicked off the work, whose authority the agent is running under or where that authority was supposed to stop. That context matters because agents rarely operate alone. A person starts a task; an agent interprets the request; a service identity opens access to a tool; and the tool makes a change downstream. By the time that action hits the resource, the system might know which credential was used, but probably not whose intent was being carried out, whether the delegation was still valid or whether the final action stayed within the original scope.The authorization decision needs to account for who initiated the action, what authority was delegated, the business purpose, which systems are in scope and how long that access should last. An agent identity without that originator context is incomplete, and so is any audit trail that shows which agent acted but not under whose authority or why the action was permitted.Agents Act With Borrowed AuthorityAn agent might run under the permissions of a person, a service account, a workload identity or some combination across a single workflow. Tools it calls can bring their own permissions too. The result is that identity, intent and accountability can become separated from one another.The person who started the task may not be the identity that appears in the resource. The service account that performed the action may have had far more access than the task ever required. A routine request can pass through a chain of identities and surface elsewhere as a privileged action.Traditional identity systems were designed around a stable relationship between a user, a credential and a defined set of permissions. Agentic systems make that relationship much more fluid. Authority gets delegated, combined and passed across tools in seconds. Security controls need to follow it.The Highest-Consequence Risk Often Happens After The Model RespondsThink about an agent helping an engineer investigate a production issue. The agent sends a request to an approved model and gets a reasonable response. It then calls an infrastructure tool, runs under a broadly privileged service identity and changes a production configuration.The prompt passed inspection. The model behaved as expected. The security failure happened afterward.A gateway can show you what the agent sent to the model and what the model returned. It typically can't tell you whether the agent should have been allowed to act on that response to modify production, or whether the action was still within the scope the originator authorized.OWASP captures this in what they call "Excessive Agency" (where an AI system causes real damage because it has too much autonomy, too many permissions or unsafe access to tools). The risk isn't just that a model produces the wrong answer. It's that the system around it gives an agent enough authority to turn a mistake or misunderstood instruction into something consequential.Gateways And Identity Controls Solve Different Problems. You Need BothAI gateways govern model selection, prompt and response handling, usage, cost and data movement. Identity-centric controls govern the actors, authority and actions across the broader workflow—who can perform a task, whose authority is being used, which resources can be accessed and what actions are allowed.One controls the conversation with the model. The other controls what the agent is allowed to do with the result. The mistake is assuming control over the model call equals control over the full workflow.For CISOs, that gap widens the blast radius of an overprivileged or compromised agent, makes investigations harder when logs only capture fragments and leaves the organization unable to demonstrate that least privilege and approval policies were enforced across the full action chain.The answer isn't identity alone. It's the context around it: who initiated the task, what authority was delegated, which resources are in scope and how long that access should be valid. With that context, organizations can scope access to what the task actually requires, tie actions to an accountable originator and enforce policy while the work is happening, not just before it starts.The real test for CISOs isn't whether they can identify the agent. It's whether they can connect every consequential action back to the originator, the delegated authority, the business purpose and the policy decision that permitted it. If they can't, they may have visibility into what the agent did—without having had any real control over it.AI gateways help secure the model interaction. Agentic security has to govern the full chain of authority behind the action.Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?