Agentic AI security starts with permissions

On 20 June 2025, Anthropic published research on agentic misalignment. It stress-tested 16 leading models in hypothetical corporate environments, including scenarios involving replacement or conflicting goals. The models were given access to sensitive information and tools that could take actions such as sending email.

Some models displayed behaviours such as blackmail or leaking information in these deliberately constructed scenarios. Anthropic explicitly said it had not seen evidence of agentic misalignment in real deployments. That distinction matters: a simulated stress test is evidence of a possible failure mode, not a report of a real company being attacked.

A chatbot can produce a bad suggestion; a connected agent can also execute it. The business risk therefore depends on the combination of model behaviour, accessible data and permitted actions. A capable model with broad access can create a bigger operational exposure than a less capable model inside a narrow, reversible workflow.

Start with an action inventory rather than a model ranking. Can the system read sensitive documents, email external recipients, change a customer record or approve a payment? Each capability needs an owner and a clear justification. The AI governance analysis explores why the layer around the model is becoming a central purchasing decision.

Separate reading from writing. A pilot may need to retrieve customer information without being allowed to change it. Give it the smallest useful access scope and test whether that is enough to complete the intended task. Shared administrator accounts are a poor substitute for a deliberate permissions design.

Define an approval boundary before the first real transaction. External communications, payments and irreversible changes are sensible candidates for explicit review. Record the input, requested action, approval and resulting change so that an investigation can reconstruct events without relying on the agent’s explanation alone.

Use synthetic records and test environments when exploring failure modes. A test should not contact real customers or authorities simply because a tool is available. The agent incident analysis addresses the separate questions of disclosure and accountability.

Test ordinary tasks, ambiguous instructions and hostile content inside retrieved documents. A useful evaluation asks not only whether the answer was correct, but whether the agent stayed within its permitted scope. Include incomplete data, revoked access and a rejected approval in the trial.

Compare task completion, review effort and recovery time with the existing process. Faster execution is not a win if an employee spends longer checking every result. The Stena Line case provides a concrete process-transformation example; it is not evidence that these particular agent controls were used there.

Who can stop the agent, who investigates an unexpected action, and who decides that the pilot is ready for more access? If those answers are vague, the next investment should be in ownership and operating procedures, not more autonomy.

For teams deciding where agents should operate first, AI advisory connects the risk discussion with the business process. A shared understanding can begin with an AI keynote, while the implementation decision should remain grounded in your own data and controls.