For decades, enterprise software was largely passive. Applications waited for users to authenticate, click buttons, submit forms, and make decisions. Security models have evolved around this assumption: verify identity, authorize access, and monitor activity.
Agentic AI changes this equation.
Unlike traditional software, AI agents don’t simply respond to requests – they think, plan, make decisions, and execute sequences of actions in enterprise systems without human intervention. Once connected to APIs, business applications, and enterprise data, these agents behave more like employees than software. The most important question is no longer “Can this agent access the application?” but “Should it perform this action right now?”
This is why companies should stop thinking of agentic AI as just another technology purchase and instead manage it as a digital insider operating at machine speed.
As the TM Forum’s Agentic Interaction Security in Telecommunications Guidebook (GB1087) rightly points out, “AI could be the ultimate ‘trusted insider’ threat,” often operating unconstrained in real-time and at scale.
Table of Contents
Authorization is not enough
Traditional security assumes that authorization is enough. If an authenticated user or application is authorized to call an API or access a database, the request is generally allowed. AI gateways have largely followed this model, adding authentication, authorization, model routing, rate limiting, logging, and content filtering.
The problem is that a sophisticated AI agent can stay completely within its authorized privileges and still produce harmful results. An agent may access too much information, perform actions outside of its intended business purpose, or combine individual legitimate API calls into behavior that poses an operational, security, or compliance risk.
Each individual request can be authorized, but the overall behavior is still wrong. This is the same insider risk that security teams have been managing with human employees for years.
The vast majority of people would never intentionally do anything that could get them fired. Human insiders are subject to context and personal ethics that do not constrain AI agents.
An accounts payable employee can access financial systems, but should not suddenly start downloading technical documentation. A customer service representative should not change personnel records just because they have valid credentials. Organizations establish expected roles and examine behavior that deviates from those expectations.
Just as the new human employees go against job descriptions and role requirements, AI agents deserve the same treatment.
Each business agent has a defined purpose: summarize contracts, solve customer problems, analyze inventory or automate IT workflows. This purpose becomes his job description.
Governance should continually evaluate whether the agent’s actions remain consistent with that task, rather than just focusing on whether each API call passes an authorization check. Therefore, modern AI security requires continuous behavioral validation throughout an agent’s session, not just verification at login.
Agentic Zero Trust continuously validates behavior
This is where “Agentic Zero Trust” expands on traditional zero trust principles. Traditional Zero Trust focuses on continuously verifying identity and enforcing least privilege access. Agentic AI requires companies to go a step further through continuous behavioral validation.
Identity tells you who the agent is. Authorization defines which resources it is allowed to access. Agentic Zero Trust asks the more important question: Is the agent behaving in accordance with its assigned role and intended business purpose? Trust is no longer established once during authentication, but is built continuously during runtime behavior.
This represents a broader architectural shift for enterprise AI. Identity and authorization remain critical and determine who or what the agent is and what resources it is allowed to access.
However, neither answer the most important governance question: “Is the agent behaving in accordance with its intended role?” As AI agents become more powerful, behavior management will become the missing control layer that complements, rather than replaces, existing identity and access management (IAM).
Treat agents as insiders
The companies that succeed with agent AI won’t necessarily be the ones that use the most agents. They will be the organizations that recognize autonomous AI for what it has become: a new category of corporate insiders.
Digital Insiders don’t need coffee breaks, don’t have to wait for business hours, and can perform thousands of actions in the time it takes a human to approve a single request. While this speed creates tremendous productivity opportunities, it just as quickly leads to errors, misuse, and compromises.
It made sense to treat AI agents as software tools when AI merely generated text. It makes no sense for AI to make decisions, interact directly with corporate systems, and execute business processes autonomously.
The future of enterprise AI will not be determined by how many agents companies use. This depends on how effectively they manage these agents after they have been granted access.
In an agent company, every AI agent should be treated as a digital insider, and every action should be evaluated through the lens of agent zero trust, where trust is continually earned through behavior rather than permanently granted through authentication alone.
https://inform.tmforum.org/features-and-opinion/agentic-ai-isnt-just-software-its-the-ultimate-insider-threat
