Nearly all companies that use artificial-intelligence agents have written rules about what data those agents may touch, but the rules are seldom enforced, and agents keep access to networks and files long after a job is done, according to Delinea’s new 2026 Identity Security Report.
The report, called The AI Enforcement Gap, found that 99.7 percent of IT and security leaders said their organizations have a formal policy governing which data AI agents can reach and how the agents are kept away from sensitive information they do not need.
The trouble is on the technical side. A policy on paper does not stop an over-permissioned agent from wandering past its assignment, and the report found that agents can retain access to company networks, applications and sensitive data even when that access is no longer necessary for the task they were originally given.
The stakes have grown as agents move past chatbot work and connect straight to business systems — databases, internal applications, cloud platforms and email. If permissions are not managed tightly, the report said, an agent could expose confidential information or act on behalf of users without enough oversight, creating security and compliance problems.
The report’s answer is to treat agents more like employees. Human users face authentication checks and access limits, and Delinea argues that agents need the same: clearly defined permissions, continuous monitoring and restrictions under the principle of least privilege, which grants only the access a job actually requires.
As agents gain autonomy and take on more of the work inside companies, the report suggests, the task for security teams is moving from writing AI governance policies to actually enforcing them.