Passing Authentication Does Not Make an AI Agent Safe

You may already use AI tools to answer customer questions, summarise documents, reconcile records, draft emails, or move information between business systems. The setup can appear secure because employees sign in normally and your software checks whether a request is allowed.

But an AI agent can pass authentication and still perform the wrong action. It may use a valid employee session, follow instructions hidden in an uploaded file, expose information through a connected tool, or continue acting after its original task has changed. For a small business, this can create problems that are difficult to investigate because the activity may appear to belong to a real employee.

The practical lesson is simple: do not judge an agent only by whether it has a valid login. You also need to know which agent is acting, who assigned the task, what the task is, which systems it may use, and what happened from start to finish.

TL;DR

AI agent security should be built in stages, beginning with an inventory and distinct identity before adding strict runtime enforcement.

Give each agent limited, short-lived access, record its activity clearly, and ensure you can stop it across connected systems when something goes wrong.

What This Means

An AI agent is different from a normal chatbot. It can make decisions, call software tools, retrieve records, and sometimes change data without waiting for a person to approve every step. That ability makes it useful, but it also means that a simple login check is not enough.

Consider a finance agent asked to match invoices with payments. It may have permission to read accounting records and update a particular reconciliation field. If the agent uses an employee’s broad access token, however, it might also be technically capable of changing supplier details, exporting customer information, or accessing unrelated files.

A gateway or security filter may see a valid token and an allowed API request. It may not know that the request came from an agent, that the agent was only assigned to read records, or that the instruction came from an untrusted document. The request is permitted at a technical level but inappropriate for the task.

A valid credential answers “who can connect?” It does not answer “should this agent perform this action now?”

The source article describes a six-gate approach to agent security. The order matters because each later control depends on information created by earlier controls. If you do not know which agents exist, you cannot assign ownership. If the agent has no separate identity, you cannot reliably attribute activity. Without attribution, behaviour monitoring and emergency shutdown become much less effective.

Security gate	What you should be able to prove
1. Agent inventory and ownership	Every production agent has a named owner, purpose, approved tools, and lifecycle status.
2. Separate identity and delegation	You can identify the agent, the employee or manager who assigned the work, and the task.
3. Task-scoped credentials	Access is limited to the required systems, data, and time period.
4. Attributable activity records	You can reconstruct the request, tool calls, data accessed, changes made, and outcome.
5. Runtime enforcement	Rules consider the agent, person, task, action, and resource, rather than the token alone.
6. Behaviour monitoring and shutdown	You can detect unusual activity and stop the agent across the systems it can reach.

How This Applies to Malaysian SMEs

For a Malaysian SME, the first step is not buying another security platform. It is making a list of every AI-enabled process already connected to your business. This may include a customer service assistant connected to WhatsApp or your website, an accounting automation connected to cloud bookkeeping software, a recruitment tool reading CVs, a sales assistant using your CRM, or a document tool connected to Google Drive or Microsoft 365.

For each one, write down the purpose, business owner, systems it can access, information it can read, actions it can perform, and whether it is still being tested or used in daily operations. If a former staff member created an automation, do not leave ownership attached only to that person. Assign a current responsible manager and record how to disable the workflow. This is especially important when your business has grown from a few employees and several tools have been added informally.

Separate identity is useful even when your team is small. Suppose three staff members use one shared AI assistant to draft quotations and update customer records. If all activity appears under one employee’s login, you may not know whether the action came from the assistant, a staff member, or an automated workflow. Create a distinct service identity or agent identity where your software supports it, while still recording which human requested the work. This preserves accountability without blaming an employee for an automated action they did not initiate.

Task limits also fit ordinary SME processes. A purchasing agent may need to read approved supplier quotations but should not be able to change bank account details. A payroll assistant may prepare a salary report but should not independently release payments. A customer support agent may view order status but should not download an entire customer database. Apply the principle of monotonic delegation: whenever work is passed from a person to an agent, the agent’s authority should stay the same or become smaller, never broader.

Think carefully about documents and messages that the agent reads. An uploaded PDF, email, spreadsheet note, or web page may contain instructions that attempt to redirect the agent. For example, a supplier document could tell an invoice-processing agent to send all records to a new email address. Treat external content as data to inspect, not as permission to change the agent’s assignment. Require human confirmation before high-impact actions such as changing bank details, deleting records, issuing refunds, or altering access rights.

Finally, check whether your records are detailed enough for an investigation. If a customer record changes, you should be able to identify the requesting employee, the agent involved, the task reference, the connected tool, the old value, the new value, and the result. This does not need to be complicated at first. A structured activity log and clear approval record are much more useful than a general statement that “AI performed the task.”

Practical Takeaways

• Create an AI agent register: list every assistant, automation, integration, and workflow that can read or change business information.
• Name one accountable owner: record a person responsible for each agent’s purpose, access, review, and shutdown process.
• Give agents separate identities: avoid hiding automated activity inside a shared staff account or personal token.
• Record delegation: capture who requested the task, what the task is, and which resources are needed.
• Reduce permissions: provide access only to the tools, folders, records, and actions required for that workflow.
• Use temporary access where possible: credentials should expire or be revoked when the task is complete.
• Separate preparation from approval: let an agent draft a payment, refund, quotation, or account change, but require a person to approve sensitive actions.
• Protect irreversible boundaries: place the strongest checks around deletion, payments, access changes, customer exports, and bank detail updates.
• Test your logs: choose one completed task and confirm that you can trace it from request to final result.
• Prepare a kill path: know how to disable the agent, revoke its credentials, disconnect its tools, and review recent activity.

A Simple Review Checklist

1. Can you name every AI agent currently used in your business?
2. Does each agent have a current owner and clearly stated purpose?
3. Can you identify the human who delegated each task?
4. Does the agent have access wider than its actual job requires?
5. Can you tell which records it viewed or changed?
6. Do high-impact actions require human approval?
7. Can you stop the agent quickly across all connected applications?

The source article also highlights a 2026 study of 205 security leaders, which reported AI-related incidents at 76% of organisations with over-privileged AI compared with 17% among organisations using least-privilege access. Source: VentureBeat, citing the 2026 Teleport study The figures should not be treated as a prediction for your own company, but they reinforce a practical priority: limit what an agent can reach before relying on advanced detection.

The Bigger Picture

AI agents will increasingly sit between your employees and the software used to run the business. The question will not simply be whether an employee is authorised. You will need to understand whether a particular agent is authorised for a specific task, under a specific person’s direction, using a defined set of information and tools.

This does not mean that you need a large enterprise security department before using automation. It means you should build good habits early. Keep an inventory, assign ownership, use narrow permissions, preserve a human approval point for sensitive actions, and maintain records that make events understandable.

Security gateways still have an important role, but they work best after the supporting context is in place. A gateway can make a better decision when it knows the agent identity, delegation chain, task scope, credential limits, and previous activity. Without those details, it may either block useful work or approve a harmful action simply because the token is valid.

For your business, the most useful starting point is one high-value workflow. Choose an agent connected to customer, financial, employee, or operational data. Document its access, narrow its permissions, add approval for sensitive actions, and test whether you can reconstruct and stop its activity. Once that foundation works, repeat the process for the next workflow.

AI automation can help your team move faster, but trust should come from clear boundaries and evidence, not from authentication alone. When every agent has an owner, a purpose, limited authority, and an observable trail, you are in a much stronger position to use automation responsibly as your business grows.

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →