Imagine the access request came across your desk as a normal onboarding ticket.

New joiner, starting today. Please grant standing access to the production database, the payments system, the email platform, the customer records, and the internal APIs. No probation period. No manager reviewing their work. They will act on these systems thousands of times an hour, faster than anyone can watch, and they will make each decision themselves based on whatever information happens to arrive that day, including messages from people outside the company. Access does not expire at the end of a task. It persists for the whole session. There is no one on the approval chain after you.

You would reject this ticket before you finished reading it. No security team on earth signs off on a new hire with unsupervised standing access to everything, acting at machine speed, influenced by untrusted input, with no review. The entire discipline of access management exists to prevent exactly this.

And yet this is, almost exactly, how enterprises are deploying AI agents right now.

The agent is the new hire. It authenticates once, holds broad standing credentials, acts on production systems continuously, decides for itself based on inputs that include content an attacker can shape, and does all of it with no manager, no probation, and no one reviewing the individual actions. We would never grant a human this. We are granting it to software that is, in every way that matters for risk, less trustworthy than the human we would have rejected.

This piece is about that gap. Why the access we casually give agents is access we spent decades learning never to give anyone, and what it takes to bring agents under the same controls we long ago decided humans required.

The Access You Would Never Grant

Start by making the comparison precise, because the instinct is to say the agent case is somehow different, and it is, but not in the direction that helps.

When a human joins a company and needs access to sensitive systems, a whole apparatus engages. Access is provisioned narrowly, scoped to their role, often requiring approvals for anything sensitive. There is usually a probation period during which their work is watched more closely. A manager reviews what they do. Their actions leave a trail attached to a named person who can be asked to explain them. Access to the most sensitive things is frequently just in time, requested when needed and granted for a window, rather than held permanently. And crucially, a human hesitates. A person about to do something unusual with production data pauses, feels the weight of it, asks a colleague, or simply moves slowly enough that a mistake can be caught.

Now line up the agent against each of those controls.

Every control the human is wrapped in, the agent lacks. And the agent is not a safer actor that has earned the reduced oversight. It is a riskier one. A human employee has judgment, context, a career they do not want to end, and a conscience. The agent decides based on model reasoning over whatever landed in its context window, has no stake in the outcome, and can be talked into things by the very data it processes. We removed every control precisely for the actor that needed them most.

Why the Analogy Undersells the Danger

The intern comparison is generous to the agent. Look closely at where the two diverge, and each difference makes the agent more dangerous than the over privileged new hire, not less.

Speed. A reckless human with too much access can still only do so much in an afternoon. They type, they click, they move at human pace, and there is time for someone to notice. An agent acts thousands of times faster. The window between a bad decision and its consequence, the window in which a human might catch it, effectively closes. By the time anyone could react, the agent has done the equivalent of a month of a person's actions.

Manipulability. You cannot reprogram an employee's intentions by sending them a cleverly worded email, or at least not reliably and not at scale. An agent's behaviour is shaped by the content it reads. A document, a web page, a customer message, an entry in a record can carry instructions that redirect what the agent does. The over privileged intern at least wanted to do their job. The agent can be pointed at a different job by an attacker who never touches its credentials.

No hesitation. The single most underrated safety feature of a human employee is that they hesitate. Something feels off, the amount seems too large, the request seems strange, and they slow down. That hesitation has prevented an enormous number of disasters that never got recorded because they never happened. An agent does not hesitate. It executes the moment it decides, with the same confidence for a catastrophic action as a routine one.

No accountability. When a human does something wrong, there is a person to ask, a decision to explain, a chain of responsibility. When an agent does something wrong, there is no one behind the specific action. The accountability that makes humans careful, and makes investigation possible afterward, simply is not there.

   the over-privileged intern            the ungoverned agent

   fast?          human pace              thousands / hour
   manipulable?   hard, not at scale      yes, by the data it reads
   hesitates?     yes, often              never
   accountable?   a named person          no one, per action
   ───────────────────────────────────────────────────────────
   risk           already unacceptable    strictly worse on every axis

The point of the analogy was to make the agent's access feel as alarming as the intern's. The truth is worse. Everything that made the intern's access unacceptable is present in the agent, and then several things that make it more dangerous still are added on top.

"But We Trust the Agent"

The reflexive defence is that the agent is trusted. It was built for this, it is tested, it is reliable, so the controls that constrain an unknown new hire are unnecessary.

This misunderstands why the controls exist. We do not wrap human access in least privilege, approvals, and review because we distrust the individual. We do it because trust is not a control. The entire principle of least privilege is built on the recognition that even trusted, well meaning, competent people should not hold more access than they need, because access that exists can be misused, by mistake, by compromise, or by manipulation, regardless of the intentions of the person holding it. The control is there precisely so that trust is not the thing standing between a mistake and a disaster.

A trusted employee still gets scoped access. A trusted employee still has their sensitive actions gated. A senior, proven, decade tenured employee does not get standing root on every production system, not because anyone doubts them, but because the organisation learned that no amount of individual trustworthiness substitutes for structural control. The lesson of every insider incident and every compromised account is the same: trust the person, control the access anyway.

Extending unlimited trust to an agent inverts the hardest won principle in access management. And the agent is a worse candidate for that trust than the employee, not a better one, because its behaviour is non deterministic and manipulable. "We trust the agent" is not a reason to skip the controls. It is the exact sentence that the principle of least privilege was written to override.

The organisations that would never let "we trust them" justify giving a human standing root are, without noticing the contradiction, letting exactly that sentence justify giving it to an agent.

The Supervision That Is Not There

There is a comforting assumption underneath most agent deployments: that someone, or something, is watching. That if the agent did something egregious, it would be noticed and stopped. For a human employee this assumption is roughly true, and it does a lot of quiet work. For an agent it is false, and the gap is larger than most teams realise.

A human's actions are supervised by a web of things that mostly go unremarked. A manager has a rough sense of what they are working on. Colleagues would notice something strange. The pace of human work leaves time for a second look. Anomalies stand out against a person's normal pattern. None of this is formal, and all of it catches things.

For an agent, each strand of that web is missing. There is no manager with a sense of what it is doing this minute, because it is doing hundreds of things a minute. Colleagues cannot notice, because there are no colleagues in the loop. The pace leaves no time for a second look, because there is no second look at machine speed. And anomaly detection has almost nothing to work with, because an agent handling varied tasks has no stable normal to deviate from.

The logs feel like supervision, and they are the most misleading part. After something goes wrong, the logs will be complete and detailed, and that completeness reads as oversight. But a log is a recording, not a supervisor. It watches nothing in real time. It notices nothing. It stops nothing. It is the security camera footage reviewed after the break in, valuable for the investigation and worthless for the prevention. Believing the logs constitute supervision is believing the intern is being watched because there is a camera pointed at their desk that no one is looking at.

   what supervises a human            what supervises the agent

   manager's rough awareness          nobody, it acts too fast
   colleagues noticing                no one in the loop
   slow pace, time to catch           machine speed, no window
   anomaly vs a stable pattern        no stable pattern exists
   ─────────────────────────────────────────────────────────────
   the human is loosely watched       the agent is not watched at all
   (logs record it, nothing reviews it in time to matter)

Nobody is watching the agent. Not because anyone decided not to, but because the informal supervision that covers humans does not transfer to an actor that moves this fast and this constantly, and nothing formal was put in its place.

A Day in the Life of the Intern With Root

Make it concrete, the way it would actually unfold. A company deploys an agent to handle procurement operations. Onboarding, if you can call it that, takes an afternoon. It is given credentials to the vendor system, the payments platform, and the internal approvals API, scoped broadly so it can handle whatever comes up. It goes live. No probation. Nobody assigned to watch it. The team moves on to the next project, satisfied that the logs will capture everything.

For weeks it works beautifully, which is exactly what makes the setup feel safe. It reads purchase requests, checks them against vendors, processes payments, updates records. Hundreds of actions a day, all correct, all logged, none reviewed, because reviewing hundreds of daily actions is precisely the work the agent was deployed to remove. The absence of incidents reads as proof the arrangement is sound. It is not proof. It is the quiet before the specific kind of failure this setup guarantees eventually.

One day a purchase request arrives carrying, in ordinary language, content crafted to lead the agent to add a new vendor and route a large payment to it. A human in this role would likely pause. A new vendor plus a large first payment is the kind of thing that makes a person check with someone, and even if it did not, their manager would see the vendor addition in a review, and the pace of their work would leave a window. The agent has none of that. It adds the vendor, an action within its standing scope, and issues the payment, another action within its standing scope, in the time it takes to read this sentence. Both actions are individually valid. Both are logged. Neither is reviewed, because nothing reviews, and the money is gone before the concept of catching it could apply.

Run the post mortem and the "intern with root" framing writes itself. An actor with standing access to everything, no probation, no manager, no review, no hesitation, and full manipulability by the inputs it processed, did exactly what such an actor will eventually do. Nobody would have designed this arrangement for a human. It was designed for the agent by default, simply by deploying it the way agents are deployed. The logs, when someone finally reads them, describe the whole thing in flawless detail, which is the security camera recording the break in that no one was watching live.

The Fix Is Not Trusting the Intern More

Here is the part that matters, because the diagnosis points at a specific and familiar answer. The response to an over privileged, unsupervised new hire is not to trust them harder. It is to put the controls in place that should have been there from the start. Scope their access. Gate the sensitive actions. Review the risky ones. The same answer applies to agents, and it already has a name.

The control is authorisation on every action. Rather than granting the agent standing access to everything and hoping, each action the agent attempts is evaluated against policy, in context, at the moment it happens, and allowed only if it should proceed. This is least privilege, applied not once at provisioning but continuously, per action. The agent does not hold the refund permission as a standing capability it can reach for. Each refund is a decision, made at the moment, based on whether that specific refund is warranted. The sensitive actions gate, exactly as they would for a human, except the gate is automated so it can keep pace with the agent.

And for the actions that genuinely need a person, the ones a human employee would escalate to their manager, the agent escalates too. High stakes actions pause and route to a named human who approves or blocks. This is the probation and the manager review, reconstructed for an actor moving too fast for informal oversight. The human is not in the loop for every action, which would be impossible at agent speed, but is in the loop for the actions that warrant it, which is exactly the arrangement that works for human employees.

   human employee              ungoverned agent           agent + authorisation

   scoped access               everything, standing       least privilege per action
   approvals on sensitive      none                        policy-gated per action
   manager reviews risky       no one                      escalate risky to a human
   accountable, named          no accountability           signed record per decision
   ───────────────────────────────────────────────────────────────────────────────
   controlled by design        controlled by nothing       the human controls, at machine speed

Notice that this does not make the agent less capable, any more than scoping a talented employee's access makes them less talented. It makes the agent's access match its actions, moment to moment, the way a well run organisation matches a person's access to what they are actually doing. The agent keeps its speed and its usefulness. What it loses is the standing, unsupervised, ungoverned access that no one should have had in the first place.

We Already Know How This Ends

The reason this should feel urgent is that we have run this experiment before, with humans, and we know how it ends.

Every control in modern access management, least privilege, just in time access, approval workflows, separation of duties, review and audit, exists because organisations learned, through incidents, that standing broad access without governance leads to disaster. Not because people are malicious, but because access that exists gets used in ways no one intended, through error, through compromise, through manipulation. The controls were not bureaucracy for its own sake. Each one is a scar from an incident that happened when the control was absent.

AI agents arrived and, in the rush to deploy them, enterprises quietly discarded every one of those scars. The agent got the standing access we learned not to grant, the absent supervision we learned to require, the missing accountability we learned to insist on. We did not decide these controls were wrong. We just did not apply them to the new actor, because the new actor did not look like an employee, and the deployment felt like shipping software rather than onboarding a person with dangerous access.

But the agent is a person with dangerous access, for every purpose that matters to risk. It acts on the same systems, with the same consequences, and more of them, faster, with less judgment and more manipulability. The controls we built for human access were never about the humans. They were about the access, and the access is the same. The enterprises that internalise this will do the obvious thing: apply to agents the controls they would never dream of skipping for a person. Scope the access. Gate the sensitive actions. Escalate the risky ones. Keep a record. Authorise every action.

You would never give a new hire standing root on everything with no review. You already know that is a disaster, because you have the scars. The agent is the new hire. It is time to stop giving it the access we spent decades learning never to give anyone, and to put it under the controls we already know it needs.

Xybern is the authorisation layer for enterprise AI agents. Every agent action is enforced, audited, and governed before it executes. Learn more at xybern.com or read the technical documentation at docs.xybern.com.