September 2026 · 5 min read
94% trust agent scoping; only 33% enforce least privilege
Key Definitions
Least Privilege Granting an agent only the minimum set of permissions required to complete its task, and revoking them when the task ends. The Cequence × EMA survey found only 33% of organizations actually provision agents this way.
Standing Permission A broad permission set granted once at agent provisioning and revisited periodically, rarely, or never. Two-thirds of organizations run agents this way, so access can quietly outlive the task it was granted for.
Just-in-time Authorization Evaluating an agent's authorization at the moment it attempts a specific action. Only 34% of organizations do this; the rest rely on periodic policy reviews or one-time standing permissions.
On August 31, Cequence Security and Enterprise Management Associates (EMA) published "Agents Without Guardrails." Among 202 enterprise IT and security leaders, 94% are confident their AI agents do not have more access than they need — yet only 33% actually provision agents with least-privilege access. The remaining two-thirds run on broad standing permissions that are reviewed periodically, rarely, or never.
The gap between confidence and enforcement
92% of respondents trust their governance frameworks. Cequence co-founder and CTO Shreyans Mehta is blunt: "Confidence like that is a trap; it's exactly why organizations stop looking for problems, stop investing in monitoring, and let authorization checks lapse until an incident forces the conversation." The report's title states the conclusion: agents are running without guardrails.
EMA VP of Research Christopher Steffen locates the crack precisely: "The gap isn't a lack of awareness; most organizations have policies in place and express real confidence in them. The gap is between what's written down and what's enforced when an agent takes an action nobody approved."
Authorization is checked at the wrong time — or not at all
Only 34% of organizations evaluate an agent's authorization at the moment it attempts a specific action. The majority rely on periodic policy reviews or standing permissions set once at provisioning and never revisited — meaning an agent's access can quietly outlive the task it was originally granted for, and keep working long after anyone signed off on it.
Scale has already passed the pilot stage
46% of organizations report they are already scaling agentic AI across multiple departments and production workflows, and 79% run generative and agentic AI simultaneously. More than 92% report an increase in AI- and bot-driven traffic targeting customer-facing applications and APIs. Scale amplifies every gap above — the broader the permissions, the fewer the checks, the more the agents, the larger the blast radius.
Abandoned pilots are leaving live credentials behind
31% of agentic AI pilots have been paused indefinitely, discontinued, or abandoned. Many were real deployments with real system access and credentials that were never cleaned up. As Steffen put it, every abandoned pilot with live credentials is exposure nobody is actively watching — it is not monitored like an online service, but the permissions are still alive.
External connectivity carries the same risk
14% of organizations allow AI agents to connect to external tools and data sources via the Model Context Protocol (MCP) without restriction. Among those that limit connections, fewer than half — just 49% — have a dedicated team actively maintaining and auditing the allowlist. Even if you have restricted external connections, there is a better-than-even chance the approved list has quietly gone stale.
Four things you can do today
Authorize at the moment of action
Validate identity, intent and permission on every action an agent attempts, rather than through periodic policy reviews. Replace "standing permission plus periodic review" with "just-in-time authorization plus immediate revocation."
Make least privilege a configuration fact, not a written principle
Give each agent only what the single task requires and revoke when it ends. Measured against the 33% enforcement rate, most organizations can quantify the gap between policy and configuration directly.
Decommission means clean up
When a pilot ends, pauses or is abandoned, revoke its credentials and service accounts immediately. Make cleanup the last step of the pilot process, not an afterthought for an audit.
Give the MCP allowlist an owner
An approved list is either audited on a schedule or you should assume it is expired. Assign an explicit team and cadence to the external-connection list — that is the half beyond 49%.
References
- GlobeNewswire: New Cequence & EMA Research — 94% of Enterprises Trust Their AI Agents Aren't Over-Provisioned; Only 33% Actually Enforce It (2026-08-31) — https://www.globenewswire.com/news-release/2026/08/31/3353329/0/en/new-cequence-ema-research-94-of-enterprises-trust-their-ai-agents-aren-t-over-provisioned-only-33-actually-enforce-it.html
FAQ
Who did this survey cover?+
EMA surveyed 202 enterprise IT and security leaders — CIOs, CTOs, CISOs and IT directors — at organizations with 1,000+ employees that are deploying or evaluating agentic AI, spanning North America and EMEA.
What do the 94% and 33% figures mean?+
94% of leaders are confident their AI agents do not have more access than they need; only 33% actually provision agents with least-privilege access. The other two-thirds run on broad standing permissions.
Why is authorization checked at the wrong time?+
Only 34% evaluate an agent's authorization at the moment it attempts a specific action. Most rely on periodic policy reviews or one-time standing permissions, so access can quietly outlive the task and keep working long after anyone signed off.
How dangerous are abandoned pilots?+
31% of agentic AI pilots have been paused, discontinued or abandoned — many were real deployments with real system access and credentials that were never cleaned up. Every abandoned pilot with live credentials is exposure nobody is watching.
How are MCP external connections governed?+
14% allow agents to connect to external tools and data via MCP without restriction; among those that restrict connections, only 49% have a dedicated team actively maintaining and auditing the allowlist.
Related Articles
Authorization is not governance: every identity check passes, yet the agent rewrote the security policy
Passing authorization is not governance — the "authorization timing" problem here is that proposition unfolding at runtime.
AI agents get retired too: forgotten agent credentials are 2026's hidden risk
31% of abandoned pilots leave live credentials — decommissioning and cleanup are the most neglected part of the agent lifecycle.
Least agency: the new security paradigm for shrinking agent permissions
Least agency offers a shrinking paradigm at the identity and permission layer — EMA's data shows it is not yet the default for most organizations.
65% of enterprises hit AI-agent security incidents — the 2026 crisis panorama
The gap between incident rates and governance enforcement is the panoramic backdrop to 2026's agent security crisis.