An Abu Dhabi-based artificial intelligence company is examining emerging cybersecurity challenges as autonomous AI agents increasingly perform tasks, make decisions and interact with digital systems on behalf of users.
Abu Dhabi AI Company Examines Security Risks as Intelligent Agents Act for Users.
As AI Agents Gain Access to Business Systems, Companies Face New Accountability Challenges
For decades, investigating a security incident inside a company’s computer network often began with a straightforward question: which user account carried out the action?
That approach is becoming less reliable as businesses increasingly introduce AI agents that can operate digital systems on behalf of employees.
These software agents are being given access to corporate email accounts, internal documents, databases and business applications. They can search information, communicate with other software and complete a sequence of tasks without requiring a person to manually approve every individual step.
While this can make businesses more efficient, it also introduces a difficult question for security teams: when an AI agent performs an action that was not expected, who should be considered responsible?
The employee may have authorised the agent to perform a particular task. The company’s systems may have legitimately granted it access. Yet the agent could make its own decision about how to complete that task, potentially leading to an action the employee never specifically requested.
That distinction is becoming increasingly important as companies move from AI systems that simply provide information to AI agents capable of taking action.
Zheng Li, co-founder and Group Vice President of Abu Dhabi-based AI company ANSEN, said the next major challenge for cybersecurity could involve an AI agent using legitimate credentials to make an inappropriate decision.
Traditional security systems have largely focused on identifying malicious users, files or processes. With autonomous AI systems, organisations may also need to determine whether a particular agent should have been permitted to carry out a specific action in the first place.
The identity problem
One of the emerging concerns is that AI agents are often operating through identities that belong to humans.
Businesses may give an agent access to an employee’s account or provide it with a long-lasting access token because doing so is relatively simple. That allows the software to connect to email, company files and other applications without requiring an entirely new identity system.
However, this can create difficulties when investigators later examine an incident.
Suppose an AI agent uses an employee’s credentials to access a database, modify a document and send information to another application. A conventional audit trail may record those actions as having been carried out through the employee’s account.
The record may not make clear which part of the activity was directly requested by the employee, which decisions were made independently by the AI and whether another connected application influenced the final action.
That creates a gap between authentication and accountability.
Knowing which credentials were used does not necessarily establish who made the decision.
The issue has attracted attention from the US National Institute of Standards and Technology, or NIST. In August, the organisation warned that some early deployments of AI agents were reproducing a familiar security weakness by relying on shared credentials and existing access tokens.
Instead of treating an AI agent as an extension of a human account, NIST has argued that such systems should increasingly be recognised as distinct entities.
Under that approach, an agent would have its own identity, credentials and permissions. Those permissions could still be connected to the employee or organisation that authorised the agent, creating a clearer chain between the human decision to grant access and the actions subsequently taken by the software.
Creating a clearer audit trail
The idea is similar to the way organisations already manage employee access.
Companies generally do not give every member of staff the same credentials or unrestricted access to every system. Instead, employees receive individual accounts and permissions based on their responsibilities.
This allows security teams to determine who accessed a system, what they were permitted to do and what actions were carried out under their account.
As AI agents become part of the workforce, researchers and security professionals are increasingly looking at whether similar principles should apply to software agents.
Microsoft has also recommended that organisations provide individual identities for AI agents and limit their access according to their specific functions.
Another important recommendation is detailed activity logging.
If an agent takes an action, an organisation should ideally be able to reconstruct the sequence of events afterwards. That means identifying what happened, determining whose authority allowed the agent to act and understanding what was changed as a result.
Such records could become particularly important during a security investigation.
An organisation might otherwise know that a particular employee’s account was involved without being able to establish whether the employee personally performed the action or whether an AI system acting through that account made the decision.
Permission does not mean unlimited authority
Giving an AI agent its own identity, however, does not eliminate the underlying security problem.
An agent can have a separate account and still be granted excessive privileges.
For example, an organisation might authorise an AI system to monitor security alerts and prepare summaries. That does not necessarily mean the same system should automatically be allowed to disable a user account, alter a security policy or shut down an important company service.
The consequences of different actions can vary enormously.
A system that produces a report may cause relatively limited harm if it makes a mistake. An AI agent that changes a security configuration or initiates an external action could have much more serious consequences.
This has led to growing discussion about applying different levels of control according to the potential impact of an action.
Li said an AI system could be allowed to carry out low-risk activities automatically while actions with significant consequences should remain subject to additional controls.
In practice, this could mean requiring human approval before an agent performs certain sensitive operations.
Connected systems can increase risk
Another challenge arises when AI agents are connected to multiple corporate systems.
An individual permission may appear relatively harmless when considered separately.
An agent might be allowed to read emails, access documents or create support tickets. But if the same agent has access to all three systems, those permissions can interact and give it considerably more capability than any single permission would suggest.
The problem becomes even more complex when agents can pass information or instructions between different software platforms.
An agent could receive information from one application, use it to make a decision and then trigger an action in another system.
As the number of connected tools grows, tracing the complete chain of events becomes increasingly difficult.
Microsoft has warned about this expansion of permissions, particularly as organisations give AI agents broader responsibilities.
The concern is not simply that an individual permission is excessive. Rather, the combination of several legitimate permissions can create capabilities that were not fully anticipated when each access request was approved.
The rise of agent-specific security standards
The growing use of autonomous AI systems is also prompting efforts to establish more specific security practices.
The Open Worldwide Application Security Project has introduced an Agent Control Standard aimed at making AI agents more observable, traceable and controllable.
The approach focuses on understanding what an agent is able to access, recording the actions it performs and providing mechanisms to restrict its behaviour while it is operating.
These principles reflect a broader shift in the way organisations are thinking about AI security.
Previously, a major question was whether a system or user was authorised to access a particular resource.
With AI agents, authorisation is becoming more granular.
Security teams may need to ask not only whether an agent can enter a system, but also which operations it can perform once it gets there.
They may also need to establish how long the permission should remain valid and whether the agent’s actions can be reconstructed afterwards.
From access control to action control
This represents a significant change in the traditional security model.
Access control generally determines whether a user or system can reach a particular resource.
Agentic AI introduces another layer: action control.
An agent might legitimately have access to a database but still not be authorised to delete records.
It might be permitted to read company emails but not send messages externally.
It might be able to identify a suspicious account but not automatically suspend that account.
Separating these capabilities could help organisations reduce the consequences of an AI system making an unexpected decision.
The challenge is creating controls that are precise enough to restrict dangerous actions without preventing agents from performing the tasks for which they were deployed.
Responsibility becomes more complicated
The question of accountability is likely to become increasingly important as AI agents move deeper into business operations.
When a human employee makes a mistake, companies generally have established procedures for determining what happened and which account was involved.
With autonomous software, the investigation may involve several layers.
There could be the employee who authorised the agent, the organisation that configured its permissions, the AI model that generated the decision and other software systems that provided information or carried out subsequent actions.
Determining responsibility may therefore require reconstructing the entire chain rather than simply identifying the account used at the end of the process.
A clear identity for each agent could help establish that chain.
Detailed records could also show when an agent received permission, what instructions it was given, which tools it accessed and what actions it ultimately performed.
Human oversight may remain necessary
The expansion of AI autonomy does not necessarily mean every action must be manually approved.
One of the main advantages of AI agents is their ability to perform routine tasks without continuous human intervention.
The security challenge is deciding where automation should stop.
Low-risk actions may be suitable for automatic execution. Higher-risk decisions could require confirmation from a human operator or additional verification by another system.
This approach would allow companies to retain some of the efficiency benefits of AI agents while placing stronger safeguards around actions that could cause significant damage.
The appropriate threshold is likely to vary between organisations and applications.
An AI assistant handling routine administrative tasks may require different controls from an agent connected to financial systems, customer information or critical infrastructure.
Building trust into autonomous AI
The rapid adoption of AI agents means businesses are having to rethink established security practices.
The technology can potentially perform work that previously required employees to move between multiple applications and carry out numerous steps manually.
But greater autonomy also means greater responsibility for controlling what the software can do.
Giving every agent unrestricted access is unlikely to provide the level of accountability organisations need.
Instead, security practices are increasingly moving towards individual identities, limited permissions, detailed logging and controls based on the potential consequences of an action.
The goal is to make it possible to answer several fundamental questions after an incident: which agent acted, what authority did it have, who authorised that authority, what instructions did it receive and what happened as a result?
A new layer of cybersecurity
As AI agents become more capable, cybersecurity is moving beyond the traditional question of whether a user is trusted.
The more difficult question may be whether an AI system should be trusted to perform a particular action under particular circumstances.
An agent could have valid credentials, legitimate access and an authorised purpose while still making an incorrect decision.
That distinction is at the centre of the emerging debate around agentic AI security.
Companies deploying these systems will therefore need to consider not just how agents enter their networks, but what they can do after entering them.
Clear identities, narrowly defined permissions, comprehensive records and appropriate human oversight could all play a role in making autonomous systems easier to monitor and investigate.
As the technology develops, the ability to reconstruct an AI agent’s actions may become just as important as the ability to prevent unauthorised access in the first place.
Why the issue is becoming important in the UAE
The questions surrounding AI identity, permissions and accountability are becoming increasingly significant in the UAE as government entities explore the use of autonomous AI systems.
The country is pursuing an ambitious programme to introduce agentic artificial intelligence into public-sector operations. The federal government has set a target of shifting 50 per cent of government sectors, services and operations towards agentic AI over a two-year period.
The planned transition includes AI systems capable of carrying out tasks independently and making certain decisions without requiring a person to intervene at every stage.
The scale of the programme means that questions about how these systems are identified, monitored and controlled are likely to become increasingly important as deployment expands.
In June, more than 300 participants representing 50 federal entities began work on identifying government services and operational processes that could potentially be suitable for agentic AI.
The initiative illustrates how the role of AI is moving beyond systems that simply answer questions or generate information.
Agentic systems are designed to take action.
They can potentially move between applications, retrieve information, complete processes and make decisions based on instructions and predefined permissions.
That additional level of autonomy creates a different set of requirements for government organisations.
Greater autonomy requires clearer controls
The UAE’s plans do not mean government AI systems will automatically receive unrestricted access to public services, databases or internal systems.
Instead, the expansion of agentic AI makes it increasingly important for organisations to establish clear boundaries around what each system can access and what it is permitted to do.
A government department deploying an AI agent may need to determine its identity, define the services it can interact with, limit its permissions and maintain records of the actions it takes.
Those records could become particularly important if an automated system makes an unexpected decision.
A conventional software application generally performs tasks according to a fixed set of instructions.
An AI agent, by contrast, may be capable of selecting among different actions as it works towards a broader objective.
That flexibility is one of the reasons organisations are interested in the technology, but it can also make the resulting activity more difficult to predict and reconstruct.
Sovereign AI and control
For the UAE, the discussion also connects with the broader concept of sovereign AI.
Li said control over AI systems should involve more than simply owning or operating the technology.
From his perspective, an organisation cannot have complete control over an AI system if it cannot determine what the system is doing, limit the resources available to it or intervene before it carries out a high-risk action.
This raises an important consideration for organisations developing or adopting autonomous AI.
The objective is not necessarily to prevent AI agents from acting independently.
Their ability to operate without constant human intervention is precisely what makes them useful.
Instead, organisations need mechanisms that allow AI to work independently within clearly defined boundaries.
An agent could, for example, be permitted to complete routine administrative processes automatically while being prevented from making decisions with significant consequences without additional authorisation.
Finding the balance between automation and oversight
One of the central challenges is finding the right balance between human supervision and machine autonomy.
If employees are required to approve every action taken by an AI agent, much of the technology’s potential efficiency could disappear.
An agent that pauses for human approval after every minor step would be little different from a conventional software tool requiring manual operation.
On the other hand, giving an AI system broad freedom to act without meaningful restrictions could introduce new operational and security risks.
The challenge is therefore to determine which decisions can safely be automated and which should remain subject to human oversight.
This distinction may become particularly important as agents are deployed across government services.
Some actions may involve routine information processing and carry relatively little risk.
Others could involve sensitive data, financial transactions, public services or decisions affecting individuals.
The controls surrounding those different categories of activity may need to be substantially different.
Human involvement does not mean manual intervention at every stage
Li said maintaining human control does not require people to personally perform every individual task.
Instead, AI can be used to handle large volumes of routine work and execute processes quickly, while people remain responsible for judgement and decisions where human oversight is most important.
“Human control does not mean a person must manually perform every step,” Li said. “AI handles volume and speed. Humans provide judgement.”
This approach could allow organisations to benefit from automation without removing accountability.
The AI system would perform the work within an established framework, while people would determine the boundaries within which it can operate and intervene when necessary.
Designing accountability before deployment
As the UAE expands the use of agentic AI, questions around accountability may need to be addressed before systems are deployed at scale.
Organisations could need to establish who is responsible for granting an AI agent access, who can change its permissions and how those changes are recorded.
They may also need to know which individual or department authorised a particular agent and what limitations were placed on it at the time.
If an agent subsequently takes an unexpected action, investigators would then have a clearer way of tracing the event.
The record would ideally show the agent’s identity, the authority under which it was operating, the resources it accessed and the sequence of actions that followed.
Without such information, an organisation could know that something happened without being able to determine exactly how or why it happened.
The importance of audit trails
Detailed audit trails could therefore become a fundamental part of government AI deployment.
As agents handle more tasks, the volume of automated activity could become enormous.
An individual agent might perform thousands of actions without direct human intervention.
Recording every relevant event in a way that can later be examined could allow security teams and administrators to reconstruct the agent’s behaviour.
The objective is not necessarily for someone to monitor every action in real time.
Instead, organisations need the ability to investigate activity when something unusual happens and determine whether the agent stayed within the authority it had been given.
This could also help organisations distinguish between a technical error, an inappropriate configuration and an action that was deliberately authorised.
Permissions must match the task
Another important consideration is the principle of limiting access according to an agent’s actual responsibilities.
An AI system designed to organise appointments may not need access to sensitive databases.
An agent responsible for processing documents may not need the ability to modify government systems.
Keeping permissions narrowly focused can reduce the potential consequences if an agent behaves unexpectedly or if its credentials are compromised.
This approach also makes accountability easier because an organisation can establish a clearer relationship between the agent’s purpose and the actions it is allowed to perform.
As agentic systems become more sophisticated, however, they may need to interact with multiple government applications.
That makes permission management more complex.
A system could begin with a limited role and later acquire additional capabilities as its responsibilities expand.
Organisations would need to ensure that those additional permissions are deliberate, documented and appropriately controlled.
The UAE’s scale makes the issue significant
The federal target of moving 50 per cent of government sectors, services and operations towards agentic AI within two years highlights the scale of the transition.
The June programme involving more than 300 participants from 50 federal entities shows that the discussion is already extending across a wide range of government organisations.
As more agencies identify suitable use cases, the number of AI systems operating within the public sector could increase significantly.
That could create new opportunities for faster service delivery and automation, but it could also increase the importance of common security and accountability standards.
If every organisation approaches AI identity and permissions differently, investigating incidents involving multiple systems could become more difficult.
Common principles for identification, authorisation, logging and intervention could make it easier to maintain visibility across a complex network of AI agents.
A different approach to traditional cybersecurity
The rise of agentic AI is changing the questions security teams need to ask.
Traditional cybersecurity has often focused on identifying whether a user or system should be allowed to access a particular resource.
With autonomous agents, access is only the beginning.
Security teams may also need to determine whether an agent should be permitted to take a particular action, under particular circumstances, with particular information.
That requires a more detailed understanding of how AI systems operate inside an organisation.
It also requires organisations to distinguish between permission to access information and authority to act on that information.
An agent could legitimately read a document, for example, without necessarily being authorised to modify it or send its contents elsewhere.
Maintaining trust while increasing automation
The success of agentic AI in government will depend partly on whether organisations can establish confidence in the systems they deploy.
Government services often involve sensitive information and decisions that directly affect members of the public.
For that reason, organisations may need strong mechanisms for monitoring and controlling AI systems as their responsibilities expand.
The challenge is to create safeguards that are strong enough to manage meaningful risks without making autonomous systems so restricted that they lose their practical value.
A system that requires approval for every minor task may be too slow.
A system with almost unlimited freedom may be too difficult to control.
The middle ground involves designing AI agents that can operate independently for routine activities while remaining subject to clearly defined limits and meaningful human intervention when necessary.
The question of responsibility remains
As AI agents become more capable and perform larger numbers of tasks, accountability could become one of the most important issues surrounding their deployment.
An agent might complete thousands of routine operations without any human intervention.
Most of those actions may never require investigation.
But if one action causes a problem, an organisation needs to be able to establish what happened.
That means knowing which agent was involved, what authority it had, which instructions it received and what other systems it interacted with.
It should also be possible to identify the person or organisation that originally authorised the agent’s access.
The more autonomous AI becomes, the more important this chain of responsibility becomes.
Looking beyond whether an AI can enter
The UAE’s growing interest in agentic AI illustrates a broader shift in how organisations are thinking about artificial intelligence.
The question is no longer simply whether an AI system can access a particular government network or application.
The more important question is what the system can do once it has access.
Can it modify information?
Can it approve a transaction?
Can it communicate with another system?
Can it trigger a process that has real-world consequences?
And if it does something unexpected, can investigators determine exactly how the decision was reached and who authorised the system to act?
These questions become particularly important when an AI agent operates at high speed and across multiple platforms.
Human judgement remains part of the system
The growing use of autonomous AI does not necessarily reduce the role of people.
Instead, it can change where human involvement occurs.
Rather than manually completing thousands of routine tasks, employees could focus on setting policies, defining permissions, reviewing exceptions and making decisions where judgement is required.
Under this model, AI provides the speed and scale, while people retain responsibility for establishing the boundaries.
That is the balance Li described when he said that AI should handle volume and speed while humans provide judgement.
For government organisations, maintaining that balance could be particularly important as agentic systems become more widely deployed.
The central question for the next phase of AI
The UAE’s plans for agentic AI point towards a future in which software systems will increasingly be able to act rather than simply advise.
That shift could transform how government services are delivered, but it also means that security and accountability need to evolve alongside the technology.
Clear identities, carefully defined permissions, reliable audit trails and appropriate intervention mechanisms could help organisations maintain control as AI systems become more autonomous.
The ultimate test may not be whether an AI agent can complete a task without human assistance.
It may be whether, after the agent has completed thousands of automated actions, people can still reconstruct what happened and establish who authorised the system to act.
As Li’s comments suggest, effective human control does not necessarily require humans to perform every step themselves.
Instead, it requires organisations to retain visibility, authority and the ability to intervene when an AI system moves beyond the boundaries established for it.
For the UAE, where the government is actively pursuing large-scale adoption of agentic AI, those principles could become an increasingly important part of the country’s approach to secure and accountable AI deployment.
