Home > Security and Compliance Blog > Cybersecurity Risk Management > AI Agent Access Is Outrunning Accountability

AI Agent Access Is Outrunning Accountability

by Patrick Spencer updated November 3, 2026 Cybersecurity Risk Management

Reading Time: 11 minutes

Your AI agents already have access to customer records, sensitive intellectual property, and HR files, and when one of them misbehaves, your organization may struggle to say who answers for it.

That is the uncomfortable picture inside 1Password’s AI agent adoption survey, which polled 1,000 full-time US employees at companies with 250 or more employees, split evenly between IT and security staff and developers. The survey was fielded from May 26 to June 3, 2026. Seventy-one percent of respondents said AI agents have access to customer data, sensitive IP, or HR information at their companies, and only 35 percent said they manage those agents under existing identity and access management processes.

Table of Contents

Access is the part everyone can see. The harder question is the one a regulator, an auditor, or opposing counsel asks after an incident. Who authorized that access, under which policy, and where is the record? An identity team can tell you who. Only a control sitting at the data layer can tell you what was touched, when, and under what policy, and then hand that over as evidence. Kiteworks secure data exchange is built around that distinction, and it is the lens this post applies to the survey.

The numbers deserve a careful read, because the interesting finding is not how many agents have access. It is how little agreement exists about who answers for them.

Key Takeaways

1. Access has outrun ownership.

Seventy-one percent of surveyed US employees say AI agents can reach customer data, sensitive IP, or HR information, yet accountability for those agents is scattered across teams, users, and executives.

2. Accountability is unsettled.

Sixty-five percent say someone other than the person currently held accountable should be, which makes agent accountability an unresolved governance decision rather than a settled org chart.

3. Identity programs cover only part of the problem.

Only 35 percent manage agents under existing identity and access management processes, and 21 percent have not formalized any approach to agentic access.

4. Credentials are the quiet failure point.

Eighty-six percent report credential-related issues with non-human identities, and 27 percent report a security incident or breach tied to overprivileged ones.

5. Evidence, not intent, is what regulators ask for.

The control that matters proves which human delegated which agent, which data it touched, and under what policy, and that proof must be producible on request.

The Survey Measured Employees, Not Incident Reports

Before building a program case on any number, name what it measures. The 1Password survey asked 1,000 US employees what they see inside their own companies. Every figure in it is self-reported, the sample is US-only, and 1Password sells identity and secrets management, so its conclusions point toward its own product category. A skeptical CISO should read it that way.

None of that makes the data useless. It makes it directional, and directional is enough when the pattern repeats in independent research, which it does later in this post. The survey also splits its sample cleanly, with 500 developers and 500 IT and security respondents, and that split produces the most revealing comparison in the report. Developers, the people who build and deploy agents, were more likely to report security gaps in agent management (67 percent) than IT and security respondents (57 percent).

Read that again. The people closest to the agents see more gaps than the people responsible for securing them. That is not a technology problem. It is a visibility problem, and visibility is the first thing an auditor tests.

You Trust Your Organization is Secure. But Can You Verify It?

Read Now

Governance Is Still a Draft While Access Is Already in Production

Start with adoption. Nearly half of developers (46 percent) said they use AI agents in production today, and another 45 percent expect to within two years. The agents are not a pilot sitting in a sandbox. They are in the workflow, and the survey says they are reaching the data that creates liability when it leaks.

Across all 1,000 respondents, 62 percent reported security gaps in how their company manages agents. Behind that headline sits a quieter number. Thirty-three percent of the IT and security respondents said they have no idea how many non-human identities or agents are in use at their company. You cannot govern an inventory you cannot count, and you cannot produce an audit record for an actor you never registered.

Then comes the process gap. Only 35 percent manage AI agents under existing identity and access management processes, and 21 percent have not yet formalized an approach to managing agentic access at all.

This is where the framing matters. Agents are a second class of identity operating beside human users, and the organization’s governance model must cover both under one policy, not run a human program and a separate, thinner agent program. A role-based access control model written for employees assumes a person who exercises judgment. An agent exercises none. It will reach whatever it is permitted to reach, at machine speed, which is why attribute-based access control evaluated at the moment of each request fits agents better than a static role ever will. The same logic is why AI data governance must start with the data, not the model. Security teams that treat the problem as a model-safety question are asking the wrong person the wrong question, a theme developed in why AI agents break traditional security models.

Accountability Lands on Whoever Is Closest, Not Whoever Should Own It

The accountability data is the part of the survey a Chief Compliance Officer should print out. Respondents were asked who is held accountable for agent actions in practice. The most common answer was team or department leadership at 24 percent. The person using the agent followed at 19 percent, then company leadership at 17 percent, and the company security team at 13 percent. Five percent said the agent itself is held accountable.

Sit with that last figure for a moment. Roughly one in twenty respondents works somewhere the accountable party is a piece of software. No regulator, court, or board accepts that answer, because software cannot be fined, sanctioned, or deposed.

The spread across the other four answers tells the real story. No single owner emerges. And when 1Password asked whether the person currently held accountable is the right one, 65 percent said a different person should be. That is an accountability vacuum, and it forms easily when one function grants access and another absorbs the risk. It echoes the argument in the authority gap in AI workflows, where delegated authority never gets written down.

Among these respondents, ownership of AI security is unsettled, so do not expect a clean org chart to solve this. Treat the ambiguity as the problem to be closed, deliberately, with a named owner for each agent.

The regulatory frame is simple, and it is the one that should drive your priorities. Regulators regulate data, not models. HIPAA’s Security Rule, for example, requires covered entities and business associates to assign a unique name or number for identifying and tracking user identity and to implement audit controls that record and examine activity in systems holding electronic protected health information. The rule carries no AI exemption. In my reading, an agent reading a patient record must be identifiable and traceable the way a nurse is, and a HIPAA compliance program that cannot attribute an agent’s access has an evidence gap before the first complaint arrives. The practical test is the one in you cannot govern what you cannot attribute.

Credentials Are the Quiet Failure Point

Agents authenticate with credentials, and the survey suggests those credentials are handled the way an overworked team handles anything it never planned to scale. Eighty-six percent of all respondents reported credential-related issues with non-human identities, and 27 percent reported a security incident or breach from overprivileged non-human identities.

The developer cut is harsher. Among the 500 developers, 40 percent said they grant agents persistent access to systems or credentials, 24 percent hardcode credentials, and 20 percent share credentials through Slack or email. Forty-three percent do not use a dedicated secrets manager or vault.

That last point deserves attention, because it exposes the weakness of policy without enforcement. Many teams have a vault. Many also have a shortcut. When an agent holds a persistent credential that someone pasted into a message months ago, the access control on paper and the access control in practice have diverged, and only one of them will show up in an audit log. This is the same gap described in permissions do not determine what AI should be allowed to use, which makes the point that what an agent is permitted to touch and what it should be allowed to use are different questions.

Compliance leaders should care for a specific reason. An overprivileged non-human identity can undermine data minimization the moment it reads more than its task requires, and it does so silently, with no user complaint to flag it.

Independent Research Shows the Same Pattern

A single vendor survey proves little. Three other sources point the same way, though two of them are vendor research.

Start with the CISO view. Vorlon’s survey of CISOs, as covered by IT Brief UK, surveyed 500 US CISOs at organizations of 500 or more employees about calendar year 2025. Of the CISOs surveyed, 30.8 percent reported unauthorized data exfiltration through SaaS-to-AI integrations, and 86.8 percent said visibility into what data AI tools exchange with SaaS applications remained a limitation of their current tools. Vorlon sells an ecosystem security platform, so weigh the figures as vendor research. The visibility figure is the useful one.

That visibility finding points the same way as the 1Password data from a different chair in the building. CISOs report limited visibility into what data AI tools exchange with SaaS applications, and 1Password’s respondents describe scattered accountability for agents. Both are signs of a structural gap, although they measure different things.

Now the practitioner view inside Kiteworks research. Kiteworks Data Security and Compliance Risk: 2026 Annual Survey Report collected responses from 459 security, compliance, and technology professionals in the second quarter of 2026, and all findings are self-reported. Sixty-five percent discovered employees using unapproved AI tools with organizational data, and only 30 percent had a formal AI kill switch or agent termination capability deployed. Shadow AI and ungoverned agents are two faces of the same failure, which is that sanctioned and unsanctioned tools alike reach data nobody mapped.

Finally, consider the government view. On August 20, 2026, the UK’s National Cyber Security Centre published a blog post, Managing the cyber risk of agentic AI. It recommends that each agent have its own unique identity, that credentials have the shortest possible lifetime, that named individuals or a group be responsible for agentic AI activity where unintended activity would have significant consequences, that organizations define when an agent must stop and seek human approval, and that logs be immutable where possible. It also says organizations should always be able to halt agent activity immediately. I read that list as an evidence checklist. Every item maps to a question a regulator can ask.

Why Identity Alone Cannot Produce the Evidence

Identity answers one question well. It tells you who or what is asking. Auditors and regulators ask four questions. Who delegated this, what data was touched, under what policy, and can you prove it? The first is an identity question. The other three are data-layer questions. This is the point made in identity knows who, data knows what, and it is why an organization can have a clean IAM program and still fail an evidence request.

The survey’s own wish list confirms the gap. When asked what they need to expand agent use, 53 percent wanted clear accountability for each agent’s actions, 52 percent wanted a centralized view of access across humans and agents, and 51 percent wanted a complete audit trail. Only 5 percent said they need nothing. Notice what those three have in common. None of them is a better model. All three are evidence and attribution controls.

That is the architectural argument for governing at the data layer. Kiteworks Compliant AI governs agent interactions with regulated data at the data layer rather than the model layer, so enforcement does not depend on a prompt, a safety filter, or a particular agent framework. Every interaction passes four checkpoints. The agent is authenticated through OAuth 2.0 and linked to the human authorizer who delegated the workflow. Access is evaluated against agent identity, data classification, and context. Data is protected with FIPS 140-3 validated encryption in transit and at rest. And each interaction lands in a tamper-evident audit trail with full attribution, streamed to the SIEM in real time.

The Kiteworks Secure MCP Server applies the same pattern to AI clients such as Claude and Copilot. It evaluates every request against role-based and attribute-based controls, so an AI client receives only the data that policy deems appropriate, and every file access, folder operation, and data retrieval is authorized, enforced, and logged. Because OAuth 2.0 authentication means each AI operation inherits the user’s existing permissions, a human and the agent working on that human’s behalf sit under one policy and one audit trail. The data policy engine is what makes that single policy enforceable across channels, and the audit logs are what turn it into something a regulator can read.

The design principle is parity. Governance that covers people but not agents leaves a fast-growing population of data consumers outside the evidence trail. Governance that covers agents but ignores the humans who delegated to them breaks the chain of accountability. Both fail the same audit.

What to Change Before the Next Audit Request

None of this requires a new category of tool before it requires a decision. Start with the decisions, because the technology only enforces what someone has written down.

Name an owner for every agent. The 65 percent who say someone else should be accountable are telling you the assignment was never made, so make it. The owner can be a role rather than a person, but it must be a named role that a regulator can call. This is also where zero trust for generative AI begins, with no agent trusted by default and every agent tied to a human who answers for it.

Count what you have. If a third of your IT and security staff cannot say how many agents and non-human identities exist, an inventory is the first deliverable. Include the credentials each agent holds and where those credentials live.

Move agents under the same identity and access management governance as humans, with short-lived credentials and no persistent secrets in chat tools. Then add data-level policy on top, so identity gates entry and policy gates what leaves.

Test the kill switch. Only 30 percent of respondents in the Kiteworks research had one deployed, and a control nobody has exercised is a hypothesis, not a control. Run a drill that halts one agent and times how long it takes to show exactly what it touched.

Finally, practice the evidence request. Pick one agent, one week, and one regulator-style question, and produce the record. If that exercise takes weeks, you have found the gap before an examiner did.

The pattern across the survey, the CISO research, and the NCSC’s recommendations is consistent. Access moved first. Accountability is trailing. The organizations that close the distance will be the ones that treat agent access as a governed, attributable, evidence-producing activity from the first request.

To learn more about governing AI agent data access in regulated environments, schedule a custom demo today.

Frequently Asked Questions

Generally, no. Regulators attach obligations to the data and to the organization that holds it, regardless of whether a person or an agent read the record. The HIPAA Security Rule’s requirements for unique user identification and audit controls, for example, contain no AI carve-out, so an agent touching electronic protected health information must be traceable. Treat agents as a second identity class under the same governance model, and map their activity to the same GRC evidence you already produce for human users.

The survey shows organizations have not settled this. Respondents pointed to team leadership (24 percent), the user (19 percent), company leadership (17 percent), and the security team (13 percent), and 65 percent said a different person should be accountable. The defensible approach is to assign a named owner to each agent before deployment and to link the agent to the human who delegated its workflow. Kiteworks Compliant AI links each agent to the human who authorized it and writes interactions to an audit trail with full attribution, so the owner is visible rather than reconstructed afterward.

Use it as direction, not as proof. The 1Password survey is self-reported, covers only US employees, and comes from a company that sells identity and secrets management. Its value is that other sources, including Vorlon’s CISO research and the UK NCSC’s blog post on agentic AI, point the same way. Build the program on your own inventory and evidence tests, and use the survey to justify running them. A zero trust data exchange approach rests on verification rather than assurances, which applies to research as well as to access.

Partly. Only 35 percent of respondents manage agents under existing IAM processes, and identity answers who is asking but not which data an agent may use for which purpose. Extend identity governance to agents, then add policy evaluated per request against data classification and context so that an agent receives only the minimum necessary data. The HIPAA Minimum Necessary Rule is a useful model for how that principle works in practice. The Kiteworks Secure MCP Server shows how per-request enforcement can sit in front of AI clients.

You should be able to show which human delegated the agent, which data it accessed, which policy allowed it, whether the data was encrypted, and a tamper-evident log of every operation. Rehearse producing that package and time it. In the survey, 51 percent said a complete audit trail is something they want in order to expand agent use, and that is a sensible place to set the standard. Start by confirming that your audit logs capture agent activity with the same attribution as human activity, then rehearse the request.

Additional Resources