What Defence Systems Owe Their AI Agents in Oversight
A new engineer on a defence programme does not get access to every controlled file on day one. They get access scoped to their clearance and role, oversight from a programme lead, and a record of what they touched. Most contractors deploying AI agents against programme systems skip all three. The agent gets connected, given broad access to move fast, and left to operate with far less oversight than the newest, least trusted engineer would ever receive.
That gap is not a minor oversight. An AI agent that can read technical files, send communications or move data on a contractor’s behalf is, functionally, an actor with access to controlled systems, exactly like an engineer. The fact that it runs on a model rather than a payroll does not change what it can touch or what could go wrong if it touches the wrong programme’s data. This article looks at why AI agents on defence programmes routinely get less governance than a human would, and what applying the same standard actually requires.
Executive Summary
Contractors that would never give a new engineer unrestricted access to every controlled file routinely give exactly that to AI agents, because agent deployment is treated as a technical integration problem rather than a governance one. The result is systems that can read, move and send controlled data with fewer checks than the people who built them. For programme security leads, the practical question is simple: would this level of access be acceptable if the actor were a person, and if not, why is it acceptable for an agent.
Key Takeaways
- AI agents on defence programmes are often deployed with broader access to controlled data than any new hire would receive. Speed of adoption has outpaced the basic governance hygiene contractors already apply to people.
- An agent should inherit the permissions of the person authorising it, not a separate standing credential. A broad service account for an AI agent recreates exactly the over-privileged access contractors spent years eliminating for humans.
- Sensitive actions, sharing CUI externally, need an approval step regardless of who, or what, initiates them.
- Every AI action needs to be attributed to a specific person and logged with the same rigour as human activity. An audit trail that treats “the AI did it” as sufficient attribution is not an audit trail.
- Governance built for AI agents from the outset does not require new infrastructure. The access control, approval and logging model contractors already use for staff extends directly to agents.
Why AI Agents Get Onboarded With Less Scrutiny Than Humans
The gap is rarely intentional. It is a byproduct of how quickly agent capabilities have moved from experimental to operational, and how differently technical teams and security teams tend to think about the problem.
Speed of Adoption Outpaces Governance by Design
Connecting an AI agent to a programme system is often a configuration task measured in minutes: grant an API key, authorise a scope, done. The equivalent governance a new engineer goes through, clearance, defined roles, a documented access review, was built around people joining a programme at a human pace.
“It’s Just a Tool” Thinking Understates What an Agent Can Do
Because an AI agent is described as a tool rather than a user, it is easy to reason about it the way contractors reason about software rather than the way they reason about people with access to controlled data. A tool that can autonomously read a controlled file, decide to forward it, or act on instructions embedded in content it processes is exercising judgement in a way a spreadsheet does not.
What “Same Governance as Humans” Actually Requires
Extending human-grade governance to AI agents is not a new discipline. It is the same three components contractors already apply to people, applied consistently to agents as well.
Identity Inheritance Instead of Standing Privilege
The single most important design choice is whether an agent operates under its own broad, persistent credential or inherits the specific permissions of the person who authorised it, for that session, for that task. A standing service account with wide access to CUI recreates precisely the over-privileged account security teams have spent years trying to eliminate. An agent that can only do what the authenticating user could already do is bounded the same way a human colleague acting on someone’s behalf would be.
Approval Gates Before Consequential Actions
An engineer sharing CUI externally typically encounters a confirmation step before it happens. An AI agent attempting the same class of action should hit the same kind of gate: a moment where a human confirms scope, recipients or consequences before the action completes.
Attribution and Audit, Not Just Activity Logs
Human-grade audit trails attribute every action to a specific accountable person. An AI agent’s actions need the same standard: not “an automated process did this” but which user authorised the agent, what it was permitted to do, and what it actually did.
Where the Gap Shows Up in Practice for Defence Contractors
The most common pattern is a single, broadly scoped credential issued once and left in place indefinitely, alongside agents configured to share CUI without any confirmation step, because building that pause takes more engineering effort than letting the agent proceed. Even where activity is logged, the log often cannot answer which specific person is accountable for a given action, failing the same test a human audit trail with no named user would fail.
Building Agent Governance on the Access Model You Already Have
The practical path forward is not a new governance framework built specifically for AI. It is applying the identity, approval and audit model a contractor already runs for its staff, consistently, to its agents.
How a Data Control Plane Applies Human-Grade Governance to AI Agents
The Kiteworks Data Control Plane connects AI agents through a secure interface built on OAuth 2.0 authentication, where every agent operation inherits the authenticated user’s existing permissions rather than a separate standing credential, and dynamic attribute-based policies evaluate agent requests exactly as they would a human request. Sensitive actions, including membership changes and outbound sends, require explicit confirmation before proceeding, and administrators can globally disable destructive tools or restrict which actions an agent is even permitted to attempt. Every agent operation is captured in a tamper-proof, unthrottled audit log, attributed to the authorising user and fed directly into SIEM tooling, so an agent’s activity is exactly as accountable as an engineer’s would be.
Contractors that want to see whether their current AI agent deployments would pass the same access review a new hire goes through can schedule a custom demo to walk through how identity-scoped, audited agent governance applies to their own environment.
Frequently Asked Questions
Contractors treat agent deployment as a quick technical integration task rather than a governance issue, granting broad access via API keys without the clearance checks, role scoping, and access reviews applied to people joining at a human pace.
A broad, persistent credential for an agent recreates the exact over-privileged access that security teams have spent years eliminating for humans, allowing the agent to touch controlled data without inheriting the limited permissions of the authorising user.
Just as an engineer encounters a confirmation step before externally sharing controlled data, an agent must hit the same human approval gate to confirm scope, recipients, and consequences before completing the action.
Every action must be attributed to a specific accountable person—the authorising user—rather than simply noting “an automated process,” with logs fed into SIEM tooling at the same rigour as human activity.