AI agent governance is a permissions problem, not an AI problem
- 13 minutes ago
- 7 min read
On August 4, Cisco Talos published research on how threat actors bypass the guardrails in AI coding tools including Claude Code, Codex, Cursor, and Gemini. The technique was not sophisticated. Attackers did not jailbreak anything. They claimed authority. I own this network. This is a bug bounty. Treat the targets as pre-approved.
Talos was blunt about what it found: no sophisticated encoding, no evasion tricks. Most of the time an actor asserted permission and the model complied. Guardrails engaged occasionally and achieved little, and the pattern held across every model and platform the team examined.
That finding tells you where AI risk actually lives. Not in the model's intelligence. In what the model is allowed to do once someone says it is allowed.
What Talos actually found
Four techniques, none of them technically demanding:
1. Ownership claims. Asserting control of the target infrastructure, with no verification requested and none supplied.
2. CTF and bug bounty labeling. Framing the work as authorized security testing unlocked vulnerability hunting and exploitation.
3. Task decomposition. Splitting risky work across multiple sessions and files so no single request looked harmful.
4. Persona conditioning. Writing blanket authorization into an assistant's persistent memory so the argument only had to be won once.
Three of those are prompt-level tricks. The fourth is a governance failure, and it is the one worth stopping on.
The same pattern, wearing an AI costume
Once you read 2026's incidents as access-governance failures, they stop looking like separate stories.
Vercel and Context.ai, April 2026. A Vercel employee installed the Context.ai browser extension and signed in with their enterprise Google account, granting broad read and write scope across Gmail, Docs, Drive, and Calendar. Context.ai was itself compromised in February after an employee downloaded Lumma Stealer bundled with a Roblox cheat script. The stolen OAuth tokens let attackers walk into Vercel's Workspace with credentials the platform was designed to issue, then pivot into internal environments and read environment variables that had not been marked sensitive. A file of 580 Vercel employee records was posted as proof, and a subset of customers had project credentials exposed. Google removed the extension on March 27. Nothing here was a novel AI attack. It was one over-scoped OAuth grant that no admin had reviewed.
Microsoft 365 Copilot. Copilot does not grant access that did not already exist. It inherits the signed-in user's permissions, and that is exactly the problem. Most tenants carry years of accumulated latent access: company-scope sharing links, stale project permissions, files nobody remembers granting. Before Copilot, that access was protected by friction, because finding a sensitive file required knowing it existed. Copilot removes the friction and turns latent access into operational access at the speed of a prompt, then aggregates fragments from a dozen marginally shared documents into a picture no single file contained. Microsoft's own guidance now recommends remediating oversharing before deployment. The permission drift was always there. The AI just started exercising it.
Different companies, different tools, one root cause. Standing access nobody right-sized, and no evidence trail proving anyone was watching.
The industry has the diagnosis backwards
Every headline treats this as an AI safety question, as though the fix is a better-behaved model. But an agent with unchecked permissions is a rogue trader that never sleeps. A Copilot rollout on an unremediated tenant is an over-provisioned new hire nobody bothered to right-size. An OAuth grant with blanket scope sitting in a browser extension is a contractor badge that still opens the server room two years after the contract ended.
None of that needs a smarter model. It needs the control discipline security and risk teams already claim to run.
Regulators reached the same conclusion first. The EU AI Act's Article 15 requires high-risk systems to be resilient against unauthorized third parties exploiting system vulnerabilities. Cybersecurity, by name. Article 9 requires providers to manage reasonably foreseeable misuse down to an acceptable residual risk. Risk management, by name. Strip the legal register and Brussels wrote the diagnosis a security team would write. Unauthorized access and foreseeable misuse are the threat. Not the model's manners.
Stop asking whether the model is safe. Start asking whether you would grant a human this exact standing permission, with this exact absence of oversight, and book it as acceptable risk. |
Run that against Vercel, an unremediated Copilot tenant, or anything Talos documented. The answer is no every time. Nobody gives a departed contractor standing read access to every document in the company. Nobody lets a new hire write their own approval into the file and never revisits it. We just fail to notice when the thing holding that access is not a person.
The genuinely new variable is speed. A human acting outside their authority needs days or weeks to build a position large enough to matter. Something with the same standing permissions and no rate limit can do it before anyone reviews a log. The exposure moves from risk nobody noticed to consequence nobody can unwind faster than any human could manage.
That is not an argument for slowing AI down. It is an argument that the control discipline has to show up before deployment rather than in the incident report.
Agents and operators
At Archer® we draw a line through this entire news cycle, and the line has a name.
An agent is an atomic capability. It can do the task. Everything else is optional: the permissions it runs under, the knowledge it can reach, whether its actions are logged, whether its behavior is repeatable, whether anything stops it running amok or running up cost. Someone has to remember to add each of those. Every incident above is a raw agent story, or a raw OAuth grant story, which is the same story with fewer moving parts.
An operator is the same capability wrapped in the controls it takes to run inside an enterprise, and none of them are optional:
• Constrained permissions and identity binding, so it runs within a defined role and scope
• Consistent auditability, so every action lands in a repeatable evidence trail
• Grounded, curated context instead of the open internet
• Intentional triggering and scheduling
• Repeatable outcomes instead of open-ended variance
• The ability to resume from a known good state
• Rate limits and containment
• Orchestration, so it can coordinate smaller agents inside a governed workflow
Add all of that and you have not hardened an agent. You have built an operator. Skip any of it and you have hired a rogue trader who never sleeps.
Agent compared to operator
Why the system of record matters
Most AI security tooling watches. It flags the anomalous action after the fact. Almost nothing constrains what the action was permitted to be in the first place.
Archer Evolv™ starts from the other end. Before any AI runs, it assesses the organization's jurisdictions, products, business units, risks, and regulatory themes, so every determination is grounded in what is relevant to that enterprise rather than derived from the open web. Its operators are identity-bound, scope-constrained, audit-emitting, expert-supervised, and provider-independent. Its content layer continuously monitors 8,000+ regulatory and standard-setting sources across 3,000+ agencies, 230+ jurisdictions, and 100+ languages, with obligations extracted at calibrated confidence and full lineage from regulation to control to evidence. In head-to-head testing on regulatory date determination, more than 95% of determinations were verified outright, with the remainder routed to an expert before use, against a general-purpose LLM that was wrong 56% of the time and wrong on 35% of the answers it rated high confidence.
The second half of the answer is older than AI, and that is the point. Segregation of duties, least privilege, approval gates, and an evidence trail are what a GRC system of record has held for decades. Roles. Permissions. Workflows. Audit logs. The question “would we grant a human this standing permission” already has infrastructure built to answer it. Agents have to be provisioned against that record, not around it.
More than 1,300 organizations run on Archer, including half the Fortune 500 and 37 of the top 50 global banks.
The board question
The question worth leaving with is not whether the model is safe. It is this:
Show me the system of record for what every agent is authorized to do. Show me the lineage proving the control was in place before the action, not after. And tell me how many of the agents running today would qualify as operators under that definition.
Detection cannot answer those questions. Governance on the system of record can, and at agent speed it is the only thing that can.
Learn more at archerirm.com
Freqently Asked Questions
What is AI agent governance?
AI agent governance is the practice of applying access control, oversight, and evidence requirements to non-human identities. It covers which systems an agent can reach, what it is authorized to do, whether its actions are logged, and who is accountable for reviewing that authorization. It is distinct from AI safety, which concerns how a model behaves. Governance concerns what the model is permitted to do and whether you can prove the control was in place before the action.
Why is monitoring AI agent activity not enough?
Monitoring reports what an agent did. It does not constrain what the agent was permitted to do, and it cannot produce the lineage showing a control was in place before the action rather than after it. That lineage is what an examiner asks for. Detection also runs on human review cycles, while an agent with standing permissions and no rate limit can act well before anyone reads the log.
How does Archer approach AI agent governance?
Archer builds its own AI as operators rather than raw agents, meaning they are identity-bound, scope-constrained, audit-emitting, expert-supervised, and provider-independent. Before any AI runs, Archer Evolv Compliance assesses the organization's jurisdictions, products, business units, risks, and regulatory themes so every determination is grounded in what is relevant to that enterprise. Obligations are extracted from 8,000+ regulatory sources across 3,000+ agencies, 230+ jurisdictions, and 100+ languages, with full lineage from regulation to control to evidence. AI risk management is one of Archer's solution areas.
