Your AI Agent Has More Authority Than Your CFO
Executive Summary
Think about what it takes for your CFO to move a large sum of money. There is a signature limit. Above it, a second approver. The payment runs through a system that separates who requests, who approves and who executes. Every step leaves a record that internal audit reviews and external auditors test. None of this exists because anyone distrusts the CFO. It exists because concentrated authority, left unchecked, eventually fails — through error, fraud or compromise.
Now think about the AI agent your organization deployed last quarter to reconcile invoices, update customer records or automate procurement. Ask the same questions. Who approved what it can do? What is the most it can do without a human in the loop? Who reviews what it actually did yesterday? In most organizations, the honest answers are: nobody in particular, quite a lot, and no one.
This is the quiet inversion of the agentic era. The most carefully governed authority in the enterprise belongs to its senior executives. Some of the least governed authority now belongs to software — software that can act at machine speed, around the clock, across systems, and that can be manipulated by the very data it reads.
Why This Matters Now
Agents have moved from experiments to production, and their access has grown faster than the controls around it. A January 2026 survey of 228 IT and security professionals by the Cloud Security Alliance and Aembit found that 74% acknowledge agents routinely receive more access than their tasks require, and 68% cannot clearly distinguish AI agent actions from human activity. Only 28% can trace an agent's actions back to a human sponsor across all environments.
The way agents get their access explains the gap. In the same survey, 43% of organizations use shared or generic service accounts for AI agents, and 31% run agents under delegated human user identities. An agent operating as a person inherits everything that person can do. An agent operating through a shared service account inherits everything every other workload on that account can do. Neither was a decision anyone made about the agent. It was a shortcut taken to ship.
The industry has started to name the problem. The OWASP Top 10 for Agentic Applications, published in December 2025, lists Identity and Privilege Abuse among its top risks and recommends a unique, bounded identity per agent with short-lived credentials. The guidance is clear. The adoption is not.
CISO2CISO Insight
We never gave a single executive unlimited authority with no second signature and no audit trail. We are doing exactly that with AI agents — and calling it automation.
The Authority Gap, Control by Control
The comparison with the CFO is useful because finance has already solved this problem for people. Every control a mature finance function applies to its executives has a direct equivalent for agents. Most organizations simply have not applied them.
Delegation of authority. The CFO operates under a written delegation of authority that states what they can approve, up to what amount, and under which conditions. Most agents have no equivalent document. Their authority is whatever the credentials they were handed happen to allow — which is rarely the same as what the business intended.
Signature limits. A CFO's approval power stops at a threshold. Agents typically have no thresholds at all: if the API allows a transaction, the agent can execute it, whether it is the first of the day or the ten-thousandth.
Segregation of duties. Finance separates the person who creates a vendor from the person who pays it. An agent that can both create records and act on them collapses that separation into a single identity — the exact pattern segregation of duties was designed to prevent.
Named accountability. Every executive action has a name attached. When agents run on shared accounts or borrowed human identities, an action in the log may belong to the agent, to a person, or to another workload entirely. Accountability dissolves.
Periodic review. Executive authority is recertified. Agent access is usually granted once, at deployment, and never revisited — even as the agent's role, tools and data sources change.
Manipulation resistance. A CFO who receives a suspicious email asking for an urgent transfer can recognize social engineering. An agent that reads an email, a document or a web page may follow instructions hidden inside it. The agent is not only powerful; it can be talked into using that power on someone else's behalf.
Why This Is a CISO Problem, Not Just an AI Team Problem
It is tempting to treat agent permissions as an engineering detail owned by whoever built the agent. That framing is how the gap was created. Agents are identities, and identities with authority are exactly what security, audit and risk functions exist to govern.
The CISO is also the executive best placed to translate the problem for the board. Directors already understand delegation of authority, signature limits and segregation of duties — they approve these frameworks for people every year. Framing agent risk in those terms turns an abstract AI concern into a familiar governance question the board knows how to ask, and knows how to hold management accountable for.
Executive Framework
| Control | Your CFO | A typical AI agent today | What good looks like for agents |
|---|---|---|---|
| Delegation of authority | Written, approved, scoped | Implicit in whatever credentials it received | Documented mandate per agent, approved by a business owner |
| Limits | Signature thresholds | Whatever the API allows | Transaction, volume and value limits enforced outside the agent |
| Segregation of duties | Request, approve and execute are separated | One identity can do all three | Agents cannot both create and act on the same high-risk record |
| Accountability | Named individual | Shared account or borrowed human identity | Unique identity per agent, traceable to a human sponsor |
| Credentials | Personal, reviewed | Long-lived, shared, rarely rotated | Short-lived, scoped credentials issued per task |
| Review | Periodic recertification and audit | Granted once at deployment | Regular access review and activity audit, like any privileged user |
| Manipulation | Trained to spot fraud attempts | Can follow instructions hidden in content | Untrusted inputs isolated; human approval above defined thresholds |
What CISOs Should Do Next
- Build an inventory of every AI agent with access to production systems or sensitive data, including agents embedded in SaaS platforms and agents built by business teams outside IT.
- Give each agent a unique identity and a named human sponsor who is accountable for what it does, and retire shared accounts and borrowed human credentials for agent use.
- Write a delegation of authority for each agent that states what it may do, on which systems, up to what limits — and have the business owner approve it as they would for a person.
- Enforce limits outside the agent itself, so that thresholds, volume caps and approval requirements hold even if the agent is manipulated or makes a mistake.
- Apply segregation of duties to agents in high-risk processes such as payments, vendor management and access provisioning.
- Bring agents into your existing access reviews and audit program, with logs that let you reconstruct what each agent did and on whose behalf.
Board-Level Questions
- How many AI agents can take actions in our systems today, and who is accountable for each one?
- Could any of our agents move money, change financial records or alter customer data without a human approving it?
- Do our agents operate under limits comparable to those we impose on our own executives?
- If an agent took a harmful action yesterday, could we tell within the hour what it did, why, and on whose behalf?
Final Executive Takeaway
Organizations did not build signature limits and segregation of duties because they distrusted their executives. They built them because authority without limits eventually fails, no matter who holds it. AI agents are now holding real authority in the enterprise, often more than the people who deployed them realize. The fix is not a new philosophy. It is applying, deliberately and quickly, the controls we already know work: a clear mandate, firm limits, separated duties, a named owner and a regular review. If your AI agent has more authority than your CFO, the question for the board is not whether the agent is trustworthy. It is why it was never asked to earn that authority in the first place.
