Can companies control what AI agents can access? Gartner finds a governance gap
In a survey of 297 cybersecurity leaders, 54% said their organisation had no defined approach to limiting AI-agent access or reused human permissions. The finding supports tighter privilege controls, but the public release omits geography, sampling and question wording.
The short version
- What happened
- Gartner says 54% of 297 cybersecurity leaders surveyed in Q2 2026 had no defined approach to limiting AI-agent access or relied on access designed for humans.
- Who it affects
- Security and IT teams may need to review agent permissions separately from employee access rather than inherit broad human roles by default.
- What remains unproven
- The release does not report geography, industry mix, organisation size, sampling frame, response rate, weighting or exact question wording.
Keep in mind
The release does not report geography, industry mix, organisation size, sampling frame, response rate, weighting or exact question wording.
The 54% figure combines organisations with no defined approach and those reusing predefined human access, without publishing the split.
The results measure reported governance and risk priorities, not verified control effectiveness, breach incidence or financial loss.
Source analysis · 2 linked sources. Primary analysed source date: 30 September 2026.
Read the full report · 5 min The evidence, methods, implications and limitations
The headline gap is about permissions, not machine intelligence
Gartner reported on 30 September that 54% of organisations represented in a survey of 297 cybersecurity leaders either had no defined approach to limiting AI-agent access or relied on permissions designed for human users. The survey was conducted in the second quarter of 2026. The combined category matters: the release does not separate organisations with no approach from those reusing human access, so it cannot tell readers how many have no control at all. It does show that a majority had not established a clearly agent-specific model by the definition used in the survey.
Gartner's central recommendation is to govern autonomous and multiagent systems by action privilege rather than a claim about how intelligent the model is. That is a practical security distinction. A modest model connected to email, code repositories, payment tools or industrial systems can cause serious harm if it can act broadly, preserve credentials or pass work to another agent. A more capable model operating in a sandbox with narrow, revocable permissions may present a smaller immediate operational risk.[1][2]
Human accounts are a poor template for persistent agents
Human identity systems often assume that one account belongs to one person who signs in, understands a task and can be disciplined for misuse. An AI agent can operate continuously, copy context between tasks, call tools at machine speed and trigger other agents. Giving it the same broad role as an employee can therefore multiply the effect of a mistaken instruction, malicious prompt, compromised integration or exposed credential. Conventional least-privilege principles still apply, but teams need to express them at the level of each tool, action, dataset and spending or change limit.
A safer design starts with a separate non-human identity for every production agent, short-lived credentials, allow-listed tools, explicit read and write scopes, transaction ceilings and high-consequence actions that require a person. Logs should record the model and version, prompt or task, retrieved data, tool calls, approvals and resulting changes. A kill switch is useful only if someone can detect a problem and invoke it in time; organisations also need rate limits, rollback paths and rehearsed incident response for actions an agent has already taken.[1][2]
A second survey describes risk perception, not attack incidence
Gartner also says 76% of more than 300 enterprise-risk leaders surveyed in the second quarter ranked AI-driven discovery of cyber vulnerabilities among their ten leading emerging risks. This is a measure of what leaders prioritised, not the number of attacks, vulnerabilities or losses. The denominator is described only as more than 300, and the public release does not say whether the respondents came from the same organisations as the 297 cybersecurity leaders.
The release connects that concern to pre-emptive defences, deepfake-resistant authorisation and preparation for post-quantum cryptography. Those topics have different evidence bases and timelines. An organisation should not buy a broad category of security product merely because leaders rank a risk highly. It should first map exposed assets and agent pathways, test concrete threat scenarios and decide whether a proposed control reduces likelihood or impact in a way that can be measured against cost and operational friction.[1]
What security teams can test now—and what would change our assessment
Teams can begin with an inventory of every deployed or piloted agent and the systems, secrets and data it can reach. For each one, ask whether the permissions are narrower than the task, whether retrieved content can issue instructions, whether another agent can inherit authority, whether consequential actions require a separate channel, and whether logs are sufficient to reconstruct an incident. Red-team exercises should include prompt injection, poisoned documents, tool substitution, repeated low-value transactions and attempts to escalate from read to write access.
Our confidence in the reported prevalence would increase if Gartner published the countries, industries, organisation sizes, sampling frame, response rate, weighting, exact questions and the split between 'no defined approach' and 'human access'. It would weaken if the sample were concentrated among Gartner clients already concerned about cyber risk or if respondents interpreted 'AI agent' inconsistently. For now, the study is a credible warning that agent permissions deserve their own control model, not a population estimate for every organisation worldwide and not evidence that 54% have already suffered an agent-related breach.[1][2]