AI Security for the Agentic Era: Who Is Accountable When AI Acts on Our Behalf?
When AI Moves from Answering to Acting
For years, our experience with artificial intelligence has largely involved asking questions and receiving answers. We enter a prompt, review the response, and decide what to do with the information provided.
That relationship is changing.
The emergence of agentic AI introduces systems capable of pursuing goals, planning tasks, using digital tools, interacting with other systems, and executing actions with varying degrees of human supervision. Rather than simply explaining how to perform a task, an AI agent may be able to perform it on our behalf.
Consider an AI agent authorised to manage business operations. It might access customer records, send emails, update databases, schedule transactions, and make decisions according to predefined objectives. Such capabilities could improve productivity and reduce repetitive work.
But they also introduce a different category of risk.
A chatbot that provides an incorrect answer may mislead a user. An AI agent with access to business systems could act on that incorrect answer, modify important records, disclose confidential information, or initiate an unintended transaction.
The more authority we give AI to act, the more important it becomes to understand, restrict, and monitor what it can do.
This is the central challenge of security in the agentic era. We are no longer protecting only the information an AI system processes. We are also protecting the people, institutions, and resources affected by its actions.
The Danger of Giving AI Too Much Authority
One of the greatest security risks associated with agentic AI is excessive permission.
For an AI agent to perform useful tasks, it often needs access to tools, files, applications, or external services. However, granting broad access simply because it makes automation more convenient can create serious vulnerabilities.
An agent designed to organise emails, for example, may not need permission to delete entire mailboxes. An assistant that analyses financial records should not automatically have unrestricted authority to transfer funds. A system that helps manage customer information should not be able to access every sensitive record in an organisation without a legitimate reason.
These distinctions matter because AI systems can make mistakes, misunderstand instructions, or respond inappropriately to malicious inputs.
An agent may also encounter instructions hidden inside documents, emails, or websites that attempt to manipulate its behaviour. If the system treats untrusted content as instructions, it could be persuaded to disclose information or perform actions its operator never intended.
Security therefore requires more than trusting an AI agent to behave correctly. It requires designing systems that limit the damage an agent can cause when something goes wrong.
Organisations should apply the principle of least privilege, granting each agent only the permissions necessary for its assigned responsibilities. Sensitive actions should require additional verification, and access should be monitored and revocable.
The objective is not to prevent AI from acting. It is to ensure that its authority remains proportionate to its purpose.
Who Takes Responsibility When an Agent Makes a Mistake?
As AI agents become more autonomous, accountability becomes increasingly important.
Suppose an AI agent mistakenly sends confidential customer information to an unauthorised recipient. The developer built the system, the organisation deployed it, and an employee granted it access. The agent performed the action, but who is responsible for the consequences?
It would be convenient to blame the machine. Yet the machine did not independently establish the organisation’s security policies, determine the acceptable level of risk, or decide that confidential information could be exposed without adequate safeguards.
Those decisions were made by people.
Responsibility may be distributed among developers, organisations, operators, and other parties, depending on the circumstances. But introducing an autonomous system does not eliminate the need to establish who is accountable for its actions.
This is why security must be considered before an AI agent is deployed, not only after an incident occurs.
Organisations need clear approval processes, reliable audit trails, defined limits on autonomous actions, and procedures for investigating failures. They must also ensure that someone has the authority and competence to intervene when an agent behaves unexpectedly.
Autonomy should never become an excuse for the absence of accountability.
The more consequential an AI agent’s actions become, the stronger the safeguards and oversight surrounding those actions should be.
Security Is Also a Question of Human Dignity
The conversation about AI security is often dominated by technical concerns: cyberattacks, unauthorised access, compromised credentials, and data breaches. These are important, but they do not tell the whole story.
Behind every compromised account may be a person whose privacy has been violated. Behind every automated financial decision may be a family or business affected by its consequences. Behind every poorly secured system may be a community exposed to risks it did not knowingly accept.
Catholic Social Teaching provides a valuable framework for understanding these implications.
The dignity of the human person requires that technological systems be developed and deployed with serious consideration for the people they affect. The common good demands that the benefits of innovation do not come at the expense of public safety, privacy, or the legitimate interests of vulnerable individuals.
From this perspective, AI security is not merely a technical responsibility. It is also an ethical one.
An organisation cannot justify exposing customers to unreasonable risks simply because automation increases efficiency. Nor should convenience take precedence over the protection of personal information and the rights of those affected by automated decisions.
The principle is straightforward: technological capability must be accompanied by responsibility for its consequences.
Building Trust in the Agentic Era
Agentic AI presents genuine opportunities. It can help organisations automate repetitive processes, coordinate complex tasks, improve accessibility, and make better use of limited resources.
Rejecting these possibilities would be unnecessary. But embracing them without adequate safeguards would be equally irresponsible.
Developers must build systems with security in mind from the beginning. Organisations must carefully assess the permissions they grant, monitor agent activity, and establish clear boundaries around sensitive operations. Users must understand that an agent’s confidence or apparent competence does not guarantee that its actions are safe or correct.
High-impact actions should receive appropriate human oversight, particularly when they involve financial transactions, confidential information, or decisions that significantly affect people’s lives.
Trust should be earned through demonstrated reliability, transparency, and effective safeguards, not assumed simply because a system is labelled intelligent.
For Yes Catholic Hangout, the emergence of agentic AI presents an opportunity to reflect on a fundamental principle of responsible innovation: the ability to delegate a task does not remove the responsibility to consider its consequences.
As AI systems gain the capacity to act on our behalf, the question is no longer simply whether we can build agents capable of performing complex tasks. It is whether we can build and govern them in ways that protect human dignity, preserve accountability, and serve the common good.
The agentic era will demand more than intelligent machines. It will demand wiser decisions from the people who create, deploy, and trust them.