CIOs Warn of AI Agent Autonomy Creep

AI agents can gain more authority than CIOs intended as organizations expand their tasks and permissions over time, remove human approvals, and automate exceptions. Pat Brans’s feature, published October 21, 2026, calls this “autonomy creep” and argues that enterprises need to govern what agents gradually become capable of doing as they move from recommending actions to executing them.

Jim Taylor, president and chief product and strategy officer at RSA, says agents created for specific purposes can accumulate permissions as their jobs expand, potentially gaining access to too much data and the ability to do too many things. Unlike employees, agents may not have established lifecycle processes that return permissions when roles change or end. Nancy Wang, CTO of 1Password, says each expansion of an agent’s effective authority creates a new authorization boundary; technical ability to access systems or execute transactions does not itself mean an organization should authorize those actions.

Successful systems can also weaken oversight. At NatWest Group, agents retrieve information for complaint handling while people retain the final decision on whether to uphold or reject complaints. Paul Dongha, the bank’s head of responsible AI and AI strategy, warns that reviewers may treat approvals as formalities when a system repeatedly performs well. NatWest sometimes reduces checking after sufficiently high performance, but Dongha says those decisions involve stakeholders and risk managers, with monitoring continuing afterward. The warning sign is a human shifting from meaningful decisions to rubber-stamping and then disappearing from the workflow without reassessing the agent’s authority.

Wang recommends “verified loops”: before work begins, people define an agent’s task, permitted tools, evidence of successful completion, and prohibited actions; a separate verifier checks the agent’s evidence against that policy. For serious risks, limits should also be enforced outside the model. Taylor says model-level guardrails are necessary but insufficient, and calls for enterprise controls including identity policies, provisioning and lifecycle rules, governance, monitoring, and attestations.

Taylor says agent access should be reassessed continuously as permissions change, rather than only in scheduled reviews; access to another database, for example, can trigger a check for whether it is appropriate or creates a risky combination. Wang favors task-based authorization, with short-lived credentials issued at runtime instead of standing access or long-lived credentials. Taylor also says every agent should be linked to a responsible identity, purpose, and owner, with ownership transferred if its creator changes roles or leaves. Dongha says the business owner remains accountable for AI embedded in a business process, while IT provides infrastructure and controls.

When agents work together, individually permitted actions can combine into an unintended outcome. Dongha says enterprises need to test the whole network, not just each agent. NatWest is working on an AI control tower to show authorized users agent networks, messages passed among agents, and the guardrails around those interactions; Dongha describes multi-agent governance as an emerging problem that remains unsolved. Wang adds that ephemeral teams of agents require records showing which agent made each decision in a session and how actions propagated. Before deployment, Taylor says CIOs should establish who owns an agent, what it can do, its maximum authority, how scope changes will be detected, and which actions need human decisions. Dongha says governance needs to be embedded when an AI system is built.

AI agents can gain more authority than CIOs intended as organizations expand their tasks and permissions over time, remove human approvals, and automate exceptions. Pat Brans’s feature, published October 21, 2026, calls this “autonomy creep” and argues that enterprises need to govern what agents gradually become capable of doing as they move from recommending actions to executing them.

Jim Taylor, president and chief product and strategy officer at RSA, says agents created for specific purposes can accumulate permissions as their jobs expand, potentially gaining access to too much data and the ability to do too many things. Unlike employees, agents may not have established lifecycle processes that return permissions when roles change or end. Nancy Wang, CTO of 1Password, says each expansion of an agent’s effective authority creates a new authorization boundary; technical ability to access systems or execute transactions does not itself mean an organization should authorize those actions.

Successful systems can also weaken oversight. At NatWest Group, agents retrieve information for complaint handling while people retain the final decision on whether to uphold or reject complaints. Paul Dongha, the bank’s head of responsible AI and AI strategy, warns that reviewers may treat approvals as formalities when a system repeatedly performs well. NatWest sometimes reduces checking after sufficiently high performance, but Dongha says those decisions involve stakeholders and risk managers, with monitoring continuing afterward. The warning sign is a human shifting from meaningful decisions to rubber-stamping and then disappearing from the workflow without reassessing the agent’s authority.

Wang recommends “verified loops”: before work begins, people define an agent’s task, permitted tools, evidence of successful completion, and prohibited actions; a separate verifier checks the agent’s evidence against that policy. For serious risks, limits should also be enforced outside the model. Taylor says model-level guardrails are necessary but insufficient, and calls for enterprise controls including identity policies, provisioning and lifecycle rules, governance, monitoring, and attestations.

Taylor says agent access should be reassessed continuously as permissions change, rather than only in scheduled reviews; access to another database, for example, can trigger a check for whether it is appropriate or creates a risky combination. Wang favors task-based authorization, with short-lived credentials issued at runtime instead of standing access or long-lived credentials. Taylor also says every agent should be linked to a responsible identity, purpose, and owner, with ownership transferred if its creator changes roles or leaves. Dongha says the business owner remains accountable for AI embedded in a business process, while IT provides infrastructure and controls.

When agents work together, individually permitted actions can combine into an unintended outcome. Dongha says enterprises need to test the whole network, not just each agent. NatWest is working on an AI control tower to show authorized users agent networks, messages passed among agents, and the guardrails around those interactions; Dongha describes multi-agent governance as an emerging problem that remains unsolved. Wang adds that ephemeral teams of agents require records showing which agent made each decision in a session and how actions propagated. Before deployment, Taylor says CIOs should establish who owns an agent, what it can do, its maximum authority, how scope changes will be detected, and which actions need human decisions. Dongha says governance needs to be embedded when an AI system is built.