E-Paper
Sign In
Abu Dhabi firm explores security concerns as AI agents act on users’ behalf
AI agents can access company emails, files and software and act on behalf of employees, but when something goes wrong, it can be unclear who authorised the action and who is responsible
- PUBLISHED: Sat 3 Oct 2026, 6:00 AM UPDATED: Sat 3 Oct 2026, 8:29 AM
For years, when something went wrong inside a computer system, investigators could begin with a relatively simple question: which account did it? That becomes harder when the person behind the account is no longer the only one acting.
AI agents are increasingly being given permission to read emails, search company files, call other software and carry out multi-step tasks on behalf of employees or organisations.
Recommended For You
The credentials may be legitimate. The agent may be authorised to enter. But if it takes an unexpected action, identifying exactly who authorised what, and where that authority ended, can become surprisingly complicated. “The next major AI-security incident may involve an authorised agent making the wrong decision with the right credentials,” Zheng Li, co-founder and Group Vice President of Abu Dhabi-based AI company ANSEN, said. “Traditional cybersecurity asks whether a user, file or process is malicious. In the agentic AI era, organisations must also ask: Should this AI be allowed to take this particular action?”
Stay up to date with the latest news. Follow KT on WhatsApp Channels.
AI agent may need an identity of its own
The issue is beginning to move from a niche cybersecurity discussion into a wider problem for companies deploying AI agents. In August, the US National Institute of Standards and Technology (NIST) warned that early agent deployments were repeating an old security mistake, sharing credentials. People and companies were allowing agents to operate through existing user accounts or long-lived access tokens because it was an easy way to connect them to email, data and business applications.
The problem is accountability. If an AI uses an employee’s account to open a database, change a file and then call another system, the logs may simply show that the employee’s credentials performed those actions. That does not necessarily reveal which actions the person requested, which the agent chose itself, or whether another tool became involved along the way. NIST argues that agents should instead increasingly be treated as “first-class entities”, with their own identifiers, credentials and permissions tied back to the person or system that authorised them.
Microsoft is pushing in the same direction. Its security guidance recommends giving each agent a dedicated identity, tightly limiting what it can access and recording the full chain of activity so an organisation can later answer three basic questions: what happened, under whose authority, and what changed. The distinction sounds technical, but the idea is familiar. A company would normally not give every employee the chief executive’s login and then rely on trust to determine who did what.
Different people receive different accounts and permissions. As AI agents begin working alongside people, security researchers are increasingly arguing that software needs a similarly clear identity trail.
The problem is what happens after access is granted
Identity alone does not solve everything. An agent can have its own account and still be given too much authority. It might be allowed to summarise a security alert, for example, but should that same agent also be able to disable an account or shut down a service without another check? Li argues that the consequence of the action should determine the level of control around it.
“An AI system may be allowed to summarise an alert automatically, but blocking a critical service, changing a security policy or initiating a real-world response should remain governed,” he said.
That is becoming a wider industry concern. Microsoft warns that agents can accumulate broad permissions as their jobs expand, particularly when one system is connected simultaneously to email, files, ticketing tools and company databases. Permissions that appear harmless individually can become considerably more powerful when combined.
The Open Worldwide Application Security Project also introduced an Agent Control Standard this month, calling for AI agents to be inspectable and traceable, including visibility over what they can access, what they did and how their behaviour can be restricted while they are operating.
The emerging security model is therefore moving beyond the question of whether an AI has permission to enter a system. It also asks what the agent is allowed to do once inside, how long that permission lasts and whether its actions can later be reconstructed.
Why it matters in UAE
Those questions carry particular relevance in the UAE as agentic AI begins moving into government operations.
The federal government is targeting the transition of 50 per cent of government sectors, services and operations towards agentic AI within two years, including systems designed for autonomous execution and decision-making. In June, more than 300 participants from 50 federal entities began mapping services and operations for potential deployment.
That does not mean AI systems will receive unrestricted authority over government services. It does mean identity, permissions and audit trails increasingly have to be designed as these systems are widely deployed.
Li argues that this should also become part of the UAE’s discussion around sovereign AI. Control, he said, is not complete if an organisation cannot see what an AI is doing, restrict what it can access or intervene before it takes a high-risk action. The challenge is preserving the reason agents are attractive in the first place. Requiring a person to approve every small action would remove much of the speed and automation they promise. Allowing an agent to operate too freely creates the opposite problem.
“Human control does not mean a person must manually perform every step,” Li said. “AI handles volume and speed. Humans provide judgement."
As AI agents become more capable, the question may therefore be less about whether they can enter a system and more about whether, after thousands of automated actions, somebody can still answer a very human question: who did what, and who was responsible for letting it happen?
Ahmed Waqqas Alawlaqi began his journalism career at 17 and now reports from Abu Dhabi on artificial intelligence, critical technologies and major national developments. His work examines the people, institutions and ideas shaping the UAE’s technological and economic future.