Enterprise artificial intelligence is entering a new stage. AI agents no longer just answer questions or generate content: they can also query databases, connect to corporate applications and carry out tasks within real business processes. This evolution broadens what they can do, but it raises a fundamental question: who controls what they are able to do?
The general availability of Microsoft Entra Agent ID, announced in April 2026, reflects the growing importance of agent identity. Microsoft proposes treating agents as distinct digital identities, with specific authentication, authorisation and access controls.
For companies, the challenge is no longer just checking whether a model produces appropriate answers. They also need to define what information each agent can consult, which operations it is authorised to perform, how its activity is recorded and who is responsible for overseeing it. Security thus becomes a necessary condition for bringing AI agents into corporate processes.
From AI assistants to agents that can take action
The evolution of artificial intelligence is changing the relationship between people and digital systems. While a conventional assistant usually responds to an instruction, an agent can use tools, consult different sources of information and carry out a sequence of actions to achieve a goal. This capability makes it possible to tackle more complex business processes, but it also raises the bar for security.
A sales agent, for example, could look up customer information, review open opportunities in a CRM and prepare a personalised proposal. Another agent dedicated to administrative tasks could process documents, extract relevant information and enter the results into an internal application. These uses can save manual work, provided that the integrations and permissions are properly defined.
The difference matters: when an AI only generates an answer, its risks usually centre on the information used and the quality of the result. When it can act on other systems, risks also appear around modifying records, sending communications, using credentials or carrying out unintended operations.
NIST, through the AI Agent Standards Initiative it presented in February 2026, recognises precisely the need to develop standards that allow agents to interact with other systems securely. The initiative addresses both interoperability and the trust these systems need in order to operate in real environments.
The business consequence is that agents must be treated as active components of the technology infrastructure. It is not enough to evaluate the artificial intelligence model they use. It is also necessary to review the applications they connect to, the credentials available to them, the operations they can perform and the consequences of unexpected behaviour.
Microsoft strengthens identity and access control for agents
One of the most significant changes is coming from identity management platforms. Organisations have traditionally managed the accounts of employees, devices, applications and services. The arrival of AI agents creates a new category of identity that needs identification and permission mechanisms suited to the way agents work.
Microsoft has developed Entra Agent ID, a platform designed to create and manage identities specifically for agents. Its aim is to let these systems authenticate and access enterprise resources without necessarily relying on conventional human accounts or on generic mechanisms designed for other applications.
This approach makes it possible to tell apart actions taken by an employee from those carried out by an agent. According to Microsoft's technical documentation on agent identities, these identities provide a foundation for managing access, applying security policies and distinguishing operations performed by autonomous systems. Identity becomes a fundamental element for setting controls and attributing activity to a specific system.
The platform also includes authorisation mechanisms designed to limit the scope of agents. Microsoft explains that Entra Agent ID restricts certain high-privilege administrative roles, precisely because an agent with excessive access could perform unexpected operations with serious consequences. Not every system needs the same permissions, nor should every system be able to change sensitive configurations.
The proposal is part of a broader trend towards security models based on Zero Trust. In this approach, no access is considered safe simply because it originates inside the corporate network. Every identity must authenticate and hold the appropriate authorisations. Applied to agents, this means that their ability to act must depend on verifiable permissions and specific policies, not on general trust in the AI model.
The risks of an AI agent with excessive permissions
The main difference between an enterprise agent and a query tool lies in its ability to interact with other systems. A model can correctly interpret an instruction and still carry out an unwanted operation if it has overly powerful tools or if there are no adequate restrictions. That is why security cannot depend solely on the artificial intelligence understanding what is expected of it.
The OWASP Top 10 for Agentic Applications 2026 identifies risks specific to agentic systems. They include tool misuse, identity and privilege abuse, goal manipulation, communication failures between agents and the consequences of autonomous actions outside the intended limits. The framework was published in December 2025 as a reference for developing and deploying agents during 2026.
One of the most significant risks is privilege escalation. An agent that needs to consult certain documents should not automatically be able to access every repository in the organisation. Likewise, an agent that prepares sales responses does not necessarily need permission to delete customers, change contract terms or alter administrative settings.
Prompt injection attacks must also be considered: external content tries to slip malicious instructions into the context the model processes. If an agent reads emails, web pages or documents, any of that content could contain instructions intended to change its behaviour. The risk increases when the system can run tools or access information that the attacker should not be able to obtain.
OWASP strengthened this analysis in September 2026 by publishing new resources for AI applications, including an agent control standard. The evolution of these recommendations confirms that agentic security needs specific architectural and operational measures. Filtering the model's responses can help, but it is no substitute for limiting permissions and controlling the actions the agent actually performs.
Identity, permissions and traceability: the foundations of secure AI
The first condition for governing enterprise agents is knowing which ones are running. An organisation needs to inventory the agents it has deployed, identify their purpose, assign each one an owner and document the systems they interact with. Without this information it is hard to know which tools have access to data or who should step in when a problem arises.
The second element is applying the principle of least privilege. Each agent should have only the permissions it needs to perform a specific function. This means separating read and write access, limiting the available operations and avoiding shared credentials with administrative permissions. Access should also be reviewed regularly to remove authorisations that are no longer needed.
The third element is establishing human oversight mechanisms. Not every operation requires individual approval, especially repetitive, low-risk tasks. However, actions with financial or legal consequences, or that involve sensitive information, may need confirmation before they are carried out. Autonomy should be graduated according to how critical the process is, rather than granted without limits.
Traceability is another fundamental requirement. Records must make it possible to identify which agent performed an operation, when it acted, which tool it used and what the result was. Depending on the risk, it may also be necessary to keep information about authorisations, versions, configurations and oversight decisions. These records should be designed to respect privacy requirements and avoid storing confidential data unnecessarily.
Finally, organisations need response mechanisms. It must be possible to deactivate an agent, revoke its credentials and restrict its connections when anomalous behaviour is detected. The agent identity administration documented by Microsoft includes precisely functions related to monitoring, access control and restricting identities. The principle applies to any architecture: a system that can act must also be able to stop safely.
How to adopt AI agents without losing business control
The answer to these risks should not be to halt the deployment of agents. Their ability to connect information, applications and processes can be useful in sales, administrative, technical and customer service departments. The aim should be to introduce them gradually within an architecture that makes it possible to verify how they work and to expand their autonomy once there are sufficient guarantees.
A good strategy starts by selecting specific, well-bounded use cases. Before launching an agent, it is worth defining what problem it solves, what data it needs, which applications it will use and which operations will be allowed. It is also necessary to identify who will be responsible for the process and in what circumstances human intervention will be required. The clearer the scope, the easier it is to set proportionate controls.
The next step is to separate the artificial intelligence model from the tools it can use. This distinction makes it possible to apply security policies that are independent of the chosen provider or model. Even if a model changes, corporate rules on access, information and operations should stay the same. This separation also makes it easier to evaluate technological alternatives without completely redesigning the governance mechanisms.
At LurNova we work from this perspective, with enterprise artificial intelligence solutions focused on control and technological sovereignty. Our MIA platform makes it possible to create specialised assistants and agents on top of corporate knowledge, with user, role and permission management and traceability. This helps organise access to information and oversee the use of AI within an enterprise environment.
LurNova AI Model Hub, for its part, makes it possible to centralise the execution and monitoring of private and commercial models, with governance policies, consumption control and interaction logging. These capabilities help build a more controlled AI infrastructure, although each agent's authorisations over external applications must be specifically designed and verified in each project.
Security will determine how AI agents scale
The adoption of artificial intelligence agents is shifting a significant part of the technology debate from the capabilities of models to their integration into business processes. It is no longer enough to check whether an agent can complete a task. It is also necessary to determine under what conditions it should do so, which resources it can access and how its decisions and actions are overseen.
Microsoft's progress in identity management and the recommendations of bodies such as NIST and OWASP point in a common direction: agents require security controls suited to their ability to act. Their own identity, least privilege, oversight, activity logs and response mechanisms are all necessary to reduce the risks of poorly managed autonomy.
This also implies a change in business responsibility. An agent can carry out operations, but it does not replace the responsibility of the people and organisations that design, deploy and use it. Defining functional owners, technical responsibilities and review procedures is as important as choosing the model or the technology platform.
At LurNova we believe that the autonomy of artificial intelligence must grow at the same pace as the ability to control it. Our principle, "If AI isn't secure, it isn't intelligent", becomes especially relevant when systems stop merely answering and start acting. Real business transformation is not about giving AI more permissions, but about letting it add value within clear, verifiable and governed limits.
If your company is bringing agents into its processes, LurNova can help you define an artificial intelligence architecture that is secure, traceable and tailored to the real needs of your organisation.
