In News
-Sathish Raman
Inside the Real-Time Push to Govern What AI Agents Are Allowed to Do
As AI agents proliferate, traditional static permissions pose significant risks. Vatsal Gupta introduces a revolutionary real-time authorization model, continuously evaluating agent actions to prevent misuse. Discover why dynamic, context-aware security is crucial for governing autonomous AI, ensuring enterprise safety and preventing costly project failures. Learn how to secure your AI future.
Software traditionally followed predefined workflows. Agentic systems can instead select tools, plan multiple steps and execute tasks with varying degrees of human supervision. Gartner forecasts that 33% of enterprise software applications will include agentic AI by 2028, up from less than 1% in 2024. That growing autonomy creates a difficult identity problem: an agent can act only through the tools and permissions it receives, but poorly scoped or long-lived authority may allow it to reach far beyond the task it was assigned. For security teams, the challenge is deciding not only what an agent may access initially, but whether that access should remain valid as its behavior and operating context change.
Vatsal Gupta, a Senior Security Engineer with 12 years in identity and access management, has spent the past two years on the question that follows: once software can act on its own, how do you decide, moment by moment, what it is allowed to do? A Senior Member of IEEE and a contributor to industry identity standards, he argues in his research and writing that the access models built for human employees fall apart when the thing holding the credentials is an AI agent. His technical breakdown of using real-time risk signals to authorize AI agents lays out an approach where permission is not granted once and forgotten but recalculated continuously as the agent works.
The Permission You Grant Is Not the Permission You Keep
Many identity systems authenticate at the beginning of a session and rely on roles, scopes or token claims that remain relatively static afterward. Although modern systems can evaluate policy on every request, those decisions may still rely on stale context unless new risk signals reach the authorization system during execution. A user logs in, the system checks their role, and access is granted for the session. That model assumes the thing behind the credential is a person who behaves in fairly predictable ways over the next few minutes or hours. An AI agent breaks that assumption. It can issue thousands of actions a minute, call other agents, and follow a chain of reasoning that no one wrote down in advance, which means the risk of any single action can swing from harmless to dangerous long after the initial grant.
Gupta’s proposed architecture treats this as a lifecycle problem rather than a login problem. He splits it into two halves. The first is getting the policy right in the first place, translating a plain-language rule about what an agent should be allowed to do into code a machine can enforce. The second, and the one he keeps returning to, is what happens after the agent starts running: keeping its behavior inside the boundary that policy defined, and pulling its access the instant it steps outside. The static permission an agent starts with, he argues, is the least interesting part of its security. What matters is whether the system is still watching by the time the agent does something that counts.
“We spent 20 years perfecting how to let the right person in the front door,” Gupta says. “Agents do not stand at the door. They are already inside, working, and the dangerous moment is rarely the login. It is the 500th action, when the context has changed and nobody is looking.”
When Your Software Outnumbers Your Staff
The scale of the problem is easy to underestimate. Inside a typical enterprise, machine identities now outnumber human ones by more than 80 to 1, and a large fraction of them hold sensitive or privileged access. Every service account, API token, and now every AI agent is an identity that can act, and most organizations cannot even list all of theirs, let alone say what each one is entitled to do. Agents make this worse because they spawn quickly, borrow the authority of whoever launched them, and often inherit far more access than the task in front of them requires.
Gupta’s answer starts by treating an agent as a first-class identity with its own scoped, short-lived authority rather than a borrowed human login. Instead of handing an agent a standing set of permissions, the system grants narrow authority tied to a specific task and a specific window, then lets it expire. He has carried that thinking into the identity standards community, contributing to specifications for how autonomous and machine identities should be described and governed, so the pattern does not stay locked inside any one company’s implementation. The aim is an agent that can only ever reach for what its current job actually needs, and only for as long as it needs it.
“An agent with permanent broad access is a loaded weapon you have handed to a process you do not fully understand,” Gupta explains. “Scope it down, time-box it, and the blast radius of a mistake or a hijack shrinks to something you can actually contain.”
Deciding in the Moment, Not at the Door
Scoping access is only half the work. The harder half is judging each action as it happens. A well-behaved agent and a compromised one can look identical for their first 100 steps, and the difference only shows up in what they try to do next. That is why the decision cannot live only at the start. It has to move into the runtime, where each request an agent makes is weighed against live context: which agent is acting, what it is trying to do, its recent activity, and how risky this particular move is right now.
This is where Gupta’s real-time approach lives. Rather than trusting an early approval, the system attaches a running risk score to the agent and re-evaluates it at every consequential step, tightening or cutting access when the signals turn wrong. A request that would sail through in a low-risk context gets challenged or blocked in a high-risk one, with no human in the loop slowing things down. His read on where AI is heading comes from more than his own systems. As a peer reviewer for the 2026 ACM International Conference on Multimodal Interaction, he evaluates new AI research before it reaches the field, which keeps his security work anchored to how these models actually behave rather than how vendors describe them.
“Static rules age badly, and they age fast when the thing they govern can rewrite its own plan mid-task,” Gupta observes. “The only authorization that keeps up with an autonomous agent is authorization that gets recomputed as often as the agent makes decisions.”
The Part That Keeps Security Teams Up at Night
None of this is theoretical caution. Gartner expects more than 40% of agentic AI projects to be scrapped by the end of 2027, with inadequate risk controls among the reasons companies pull the plug. The pattern is familiar. A team ships an impressive agent, then discovers it can be steered off course by a cleverly worded input, or that it quietly accumulated access no one reviewed, and the project stalls under its own risk. Governing what an agent can do is turning out to be harder than building the agent in the first place.
The failure Gupta designs against occurs when an agent’s observed behavior diverges from the task and authorization boundaries established by its operator. An agent assigned to summarize invoices should never be issuing payments, and the instant it tries, the system has to notice and stop it rather than wait for a nightly audit. Building that is genuinely hard. The system has to understand what the agent was supposed to be doing, detect the divergence quickly enough to matter, and revoke access without breaking every legitimate agent around it. Get it too loose and a hijacked agent runs wild. Get it too tight and useful automation grinds to a halt on false alarms, which is its own kind of failure.
“The nightmare is not an agent that fails loudly. It is one that keeps working while doing the wrong thing,” Gupta reflects. “By the time a quarterly review catches it, the damage is weeks old. Real-time governance exists so that the gap between going wrong and getting caught shrinks to almost nothing.”
Toward Context-Aware Permissions
The industry is inching in this direction. Access is starting to be expressed as intent, a statement of what should be allowed and under what conditions, with software working out the specifics in real time instead of an administrator manually writing rules for every case. Standards bodies are drafting the shared language that will let one company’s agent prove what it is allowed to do to another company’s system. Continuous, context-aware authorization, still exotic a few years ago, is on its way to becoming the baseline expectation for anything that runs without a human watching.
Gupta sees the endpoint as authorization that behaves less like a locked door and more like a judgment call made fresh each time. His standards work is aimed at making that portable, so the way an agent’s authority is described and checked stays consistent across tools and vendors rather than reinvented badly by each team. He is candid that the field is early and that most organizations are still governing agents with identity and authorization models originally designed around human users. What he is working toward is a world where an agent’s access is as dynamic as the agent itself, evaluated on the facts of the moment and revoked the second those facts change.
“Every autonomous agent is a small act of trust that a company extends thousands of times a day,” Gupta notes. “You cannot base that trust on a decision made once, months ago. You earn it back, or lose it, on every single action, and the systems we build have to keep score in real time. That is the whole game now.”
