Source: Featured Blogs - Forrester
As AI systems move from passive tools to autonomous agents making decisions independently, the traditional "least privilege" security model—which simply restricts what an agent can access—has become insufficient. Agents need constraints on *what they can do* with their access, not just *what they can reach*. This requires new governance architectures like action approval layers, outcome monitoring, and decision reversibility that current enterprise security frameworks don't provide. Security teams must now collaborate with AI teams to define permissible agent behaviors rather than just managing credentials and permissions.