Governing AI agents: the next privileged user may not be human
Enterprises are deploying AI agents faster than they're deciding what those agents are allowed to do. Increasingly, agents operate inside the same systems and the same sessions as the people who deployed them, carrying that person's authority into applications built to trust a human on the other end. When an agent acts, the audit log often can't tell you whether it was the person or the agent. Governing agentic AI means setting the boundary before the work starts and being able to hold something accountable for what happened after.
Today, we’re announcing a series of innovations in our Citrix SecurAccess portfolio, which will address problems just like this. Building on Hector’s post on Monday which set out four capabilities an adaptive enterprise needs: access, governance, control and visibility; this post is about governance: the rules and accountability behind the work agents do.
Let’s explore a scenario of what is happening in organizations today, the problems that are exposed, and how SecurAccess is going to solve them.
A moment in the life of a finance employee working with an AI agent
Picture this: someone in finance asks an AI agent to sort out a disputed supplier payment. The agent goes into the ERP system using that person's access, which includes the ability to edit vendor records because the person occasionally corrects supplier details as part of their job. While working through the dispute, the agent finds that the bank details on file don't match those on the supplier's latest invoice. It decides that updating the vendor's bank account is the quickest way to resolve the dispute and releases the payment to the new account, then moves on to the next item on its list.
The agent never exceeded the access it was given. The person it was acting for was allowed to edit vendor records, but they would have known to verify a change of bank details with the supplier first, since a mismatch like that is a classic sign of invoice fraud. The agent had the same permission without the same judgement, and nobody had decided in advance what it should be allowed to do with it.
The obvious problem: An AI agent inherits more than permissions
When an employee hands a task to an agent, the agent takes on more than their access rights. It acts under their identity, holds their privileges, and carries the work across every device they use. Traditionally, the employee's judgment is what made that broad access safe: a person doing a payment lookup doesn't reach for payment-approval rights they haven't touched in months, because they know the task doesn't call for it. The agent has no equivalent judgment. It has the same standing access and no reason to not use all of it.
The result is that every unused permission in the employee's role can now be triggered by one wrong step in the agent's reasoning, one misread instruction, or one manipulated document.
Every control worked. The payment changed anyway. Where was the AI governance gap?
Most organizations already have controls along this chain. Identity providers check who is acting. Applications enforce their own permissions. AI platforms govern agents inside their own environments. In the finance scenario, each of those controls did its job correctly.
None of them knew what task the agent had been given, so none could judge whether a given action belonged to it. And most enterprises won't standardize on one agent platform. Whichever platform an agent comes from, its work ends up in the same place: acting on the same applications, under the same employee's credentials. That's where governance needs to apply.
Today, we’re announcing new Citrix SecurAccess controls to govern AI risks.
Citrix has spent decades making sure access decisions happen at the point where work happens. The actor has changed, so what gets evaluated at that point has to change too. The following capabilities are planned for release in the Citrix SecurAccess portfolio this quarter:
- Autonomous browsing activity detection. Citrix SecurAccess with Chrome Enterprise will be able to tell when automation, not a person, is driving the browser. Administrators can then choose how to respond: monitor the activity, notify the user, record the session or block it. You can't govern an actor you can't tell apart from a person.
- Agentic access governance. Citrix SecurAccess ZTNA will become a policy control point to ensure that AI agents can access only the tools and actions it needs for a specific task through Model Context Protocol (MCP), not everything its user can access. In the finance scenario, the agent could have reviewed the disputed payment without being able to change vendor bank details or release funds, even though the employee who assigned the task could.
- Session Insights with AI governance. Session Insights for Citrix SecurAccess with Chrome Enterprise already captures, analyzes and helps organizations understand browser activity from both users and autonomous agents. New AI capabilities will highlight potentially risky moments in a session. That helps security teams investigate faster and keep an auditable record of how an agent used the authority it was given.
Delegated authority for AI agents has to be designed, not assumed
Governance means somebody made a decision. Four questions need answers before an agent starts work:
- Whose authority does the agent carry?
- Which operations does the task actually require?
- Which operations stay off-limits?
- When does a person need to approve?
In the finance scenario, answering those questions before the agent started would have kept payment-approval out of reach for a payment-dispute lookup, regardless of what the employee's role otherwise allowed.
These decisions get harder once agents are built into financial, operational and customer-facing processes, where broad access is already part of how the work runs. The principle is clear enough to act on now: authority granted at the scope of a person, not the scope of a task, is authority nobody has evaluated.
Learn more about what we are releasing through the TechZone blog post and demo videos:
The capabilities described are planned to become available this quarter. Timing, scope and platform support may change before release.