Experts warn of 'autonomy creep' as AI agents gain unchecked authority

Security leaders at RSA, 1Password and NatWest describe how AI agents accumulate permissions and authority beyond their original scope. They recommend enforcing limits outside the model, verifying access continuously and authorizing agents per task rather than granting standing access.

• Agents gain permissions and data step by step and rarely give them back
• Model-level guardrails are necessary but not sufficient; limits must sit in enterprise controls
• Periodic access reviews are too slow for dynamic agent identities
• Risk grows when humans stop meaningfully reviewing a reliable AI's decisions