Employee-built AI agents need owners before guardrails

The agent the sales director's team assembled in Cursor last month is probably still running. It reads from the CRM, drafts follow-ups and holds API credentials that were scoped for a proof of concept. Nobody has looked at its permissions since the demo worked, because nobody owns it.

SecurityWeek reported on 14 September that Team8's annual survey of enterprise CISOs puts AI and agent security at the top of the agenda. 78% call it their biggest pain point, exactly twice the next item. Most CISOs are already experimenting with or augmenting existing security tools using AI agent capabilities. The most instructive detail is not the number, though. It is where these agents come from.

Team8 CISO Tim Brown described employees creating agents "from simple to complex" using "easily available coding tools like Claude Code, Cursor and Codex". One agent might summarise an inbox. Another might rework a sales process using enterprise data and recommend where people should focus. Some become load-bearing before security knows they exist. Brown calls the agent "a very resourceful employee that will do whatever it takes to accomplish the task it believes it has been given."

The natural reflex is to buy something that intercepts the agent at runtime. That may become necessary. But most mid-market organisations are not fighting a runtime battle yet; they are fighting an inventory battle. They do not know which agents exist, what each one can reach, or who is accountable when an instruction is interpreted destructively. A product cannot govern an estate that has not been named.

The agents are already inside the estate

For an organisation without a full-time security leader, adoption looks like a series of one-off decisions. A team asks whether it may connect a tool to the CRM. Someone says yes to keep the project moving. The same two people who manage identity are also approving marketing automation, so the approval is pragmatic rather than assessed. Six months later, an agent holds production credentials and no owner.

That is a governance failure before it is a technical one. Brown's recommended guardrails — limiting where an agent can go and what it can do at development time — only work if development is visible. In a mid-market organisation, it usually is not.

Ownership is the missing control

A usable AI-acceptance process does not need a dedicated security team. It needs three things: an inventory of agentic tools, a named owner for each, and a rule about the least privilege an agent needs. The first pass is less technical than it sounds.

A virtual CISO engagement can install that process without an internal hire. The work fits inside a normal quarter: run lightweight discovery across departments, classify each agent by the data and credentials it touches, and record an owner and review date. That record becomes something management can read and challenge.

The most useful questions are simple:

• Which agents exist today, and who owns each one?
• What data and credentials can each agent actually reach right now?
• What is the narrowest permission that still lets the business outcome work?

The third question is where value and security meet. Brown is clear that guardrails can be made perfectly safe by switching the system off. The harder discipline is to constrain an agent enough that a misinterpreted instruction stops inside an acceptable boundary.

A process that keeps pace with adoption

For most of the past decade, security lagged behind each new technology and was then blamed for blocking it. Agentic AI is moving faster, and the window is shorter. By the time a team makes its first serious agent deployment, the pattern has already been set: someone connects, someone approves, someone forgets.

A scored self-assessment can show where the gaps are before the next request arrives. The point is not to stop agents. The point is to make sure each one has an owner, a boundary and a review date before it becomes part of a revenue process. That is a management task as much as a security one, and it is precisely the work a part-time senior security advisor is built for.

The agent the sales director's team built will keep running until an owner exists. The cheapest moment to constrain it is before it becomes someone's workflow.