seguridad agentes de ia gobierno de ia cumplimiento

AI Agent Security: Real Risks and How to Govern Them

2026-08-21T07:15:02.166+00:00 · CompaniesAutomation

The four real risks of an AI agent in the enterprise and the engineering control for each: least privilege, human approval, full traceability, and cited sources. Featuring a 5-point governance framework applicable to any SME.

The security of AI agents doesn't depend on whether "AI is safe," but on how each agent is built: what permissions it has, at which points it requires human approval, and what record it leaves of every action. A well-governed agent operates with the minimum essential access, requests authorization before touching payments or external communications, and documents every step it takes. A poorly built agent does not. That is the whole difference.

It is the number one fear of any executive evaluating this technology, and it's a reasonable fear: what if the AI does something it shouldn't? The short answer is that an autonomous AI agent does exactly what its engineering allows it to do, no more and no less. Real incidents don't come from "uncontrolled" AI, but from poorly built agents: with more access than necessary, without checkpoints, and without a log of what they did. This guide reviews the four risks that actually matter, the specific control for each, and a 5-point governance framework that any SME can apply from the first week.

What are the real risks of an AI agent in the company?

The real risks of an AI agent in a company are four, ordered by probability and impact: excessive data access, unsupervised actions at critical points, hallucinations in customer responses, and data leakage to model providers. All four are engineering risks and all four have known and applicable controls today. None require waiting for "AI to mature."

Excessive data access. The most frequent risk and the least discussed. An agent connected "to everything"—the entire ERP, the management email, the full shared folder—can expose information it never needed for its task. The problem is not the AI: it's having given it keys to rooms where it has no business being.
Unsupervised actions at critical points. An agent that executes payments, sends communications to customers, or modifies master data without anyone approving the step turns a one-off error into a serious problem. The severity lies not in the frequency of the failure, which is low, but in its unit cost, which is high.
Hallucination in customer responses. A language model can state something false with total certainty: an invented delivery deadline, a non-existent contractual condition, or an old price. If that response reaches a customer without control, the damage is commercial and reputational.
Data leakage to model providers. If employees paste sensitive information into free consumer tools, that data goes beyond the company's control. This is a real risk—but one of ungoverned use, not of well-contracted corporate agents, which operate under agreements where your data is not used to train models.

How is each risk controlled?

Each risk has a specific engineering control; in total there are five practices, because traceability protects against all of them at once. None are exotic: they are the same disciplines that banking or healthcare have applied to their software for decades, adapted for agents.

1. Principle of Least Privilege. The agent accesses only the data and systems its task requires, and nothing more. An agent that reconciles invoices reads invoices and bank statements; it doesn't read payroll or email. In practice, this is implemented with unique credentials per agent (never an employee's), read or write permissions defined system by system, and quarterly access reviews. If anyone asks tomorrow "what can this agent see?", the answer should fit in a one-page table.

2. Human approval points where it matters. Not everything requires supervision; critical points do. The rule of thumb: any irreversible or high-cost action—executing a payment, sending an email to a customer, deleting records—goes through human approval, and the rest flows automatically. This is how, for example, accounts payable automation with AI agents works: the agent receives, validates, and prepares the payment; a person approves it with one click. 95% of the work is done by the machine; the decision to move money remains human.

3. Full traceability of every action. Everything the agent does is recorded: who (which agent, which version), what (the exact action and the data involved), when (timestamp), and why (what instruction or rule triggered it). This log is non-negotiable and is also what allows for auditing, debugging, and demonstrating compliance. We apply this standard even in the most demanding environments: we have built compliance systems for hedge funds and family offices where every agent action must be reconstructible for an auditor.

4. Responses with cited sources. Against hallucination, the control is to force the agent to respond using your company's knowledge and to cite where each statement comes from: the document, the policy, the product sheet. If the agent doesn't find the answer in the authorized sources, it says "I don't know" and escalates to a person—it doesn't fill the gap with invention. A customer service agent without cited sources isn't an assistant: it's a crisis draft.

5. Data that doesn't leave company control. Corporate agents operate under enterprise contracts where the model provider does not use your data for training and commits to defined retention periods. For especially sensitive information, there are architectures where the data doesn't even travel: the agent queries internal systems and shares with the model only the minimum context necessary for each task. This is decided during design, not after.

A 5-point agent governance framework for your SME

You don't need an AI ethics committee or a 40-page internal policy. You need five decisions written on a two-page document, with a name and surname next to each one:

Agent and access inventory. A table: each agent, which systems it touches, with what permissions (read or write), and what data it sees. It's reviewed every quarter. If an agent isn't in the table, it isn't in production.
Human approval thresholds. In writing: which actions require approval. Common ones: payments above a certain amount, any external communication, changes in master data. Thresholds can be relaxed over time—when the log proves months of clean operation—but you start conservatively.
Audit log active from day one. Every action with its who/what/when/why, in a storage location that the agent itself cannot modify. No log means no deployment: this rule has no exceptions.
Cited sources rule. Any agent responding to customers or employees using company knowledge cites its sources and escalates what it doesn't know. Before going into production, it's tested with a set of trick questions—questions with no answer in the documentation—and it must escalate all of them.
One internal owner per agent. A specific person who reviews the log (30 minutes a week is enough at first), collects incidents, and decides on adjustments. Agents without owners degenerate; with an owner, they improve every month.

This framework is the foundation we use when designing an AI-managed company: governance first, agents second. Setting it up the other way around—deploying first and governing "when there's time"—is a recipe for disaster.

Is an AI agent more auditable than a manual process?

Yes: a well-built agent is more auditable than the manual process it replaces because it records every action, whereas a human does not. When an administrative clerk approves an invoice, copies data between systems, or answers an email, there is no structured record of what they saw, what criteria they applied, or what they touched; when an agent does it, everything is logged. The honest question is not "is AI safe?", but "how auditable is my current process?"—and the answer is often uncomfortable.

This doesn't make the agent infallible: it makes mistakes, which is why approval thresholds and internal owners exist. But it changes the nature of the error. Human error is silent and discovered late; an agent's error is logged instantly, with full context, and corrected permanently by adjusting the rule that caused it. A person can repeat the same oversight for years; a corrected agent never commits it again.

What do European regulations (GDPR and AI Act) require?

GDPR essentially requires what this framework already provides: data minimization (least privilege), a clear legal basis for each processing activity, a data processing agreement with the model provider, and the ability to demonstrate what was done with each piece of data (traceability). The AI Act, being phased in from 2025, classifies most of an SME's internal agents—administration, finance, support—as limited risk: obligations focus on transparency (making it known that one is interacting with an AI) and documenting the system. High-risk requirements are reserved for uses like hiring or credit decisions.

The practical takeaway for a Spanish SME: if you apply the 5-point framework, most compliance comes standard. The traceability an auditor asks for and what GDPR requires are the same record. That's why we insist on building it from day one rather than adapting it later: retrofitting traceability onto a running system costs, in practice, three times as much.

If you are evaluating deploying agents and want to start with governance well-resolved—permissions, approvals, and logging designed before writing a single line of agent code—that is exactly the work of the diagnostic phase of our AI consulting: leaving with a risk map of your specific processes and controls sized to your scale, not a bank's.

Frequently Asked Questions

Can an AI agent access all my company's data?

Only what you explicitly connect it to. A well-designed agent operates with its own credentials and least privilege permissions: it sees the data its task requires and nothing more. If a provider suggests connecting the agent "to everything" to simplify things, that's red flag number one.

What happens if an agent makes a mistake on a payment or sends something it shouldn't?

In a serious deployment, it never gets executed: payments and external communications go through a human approval point, so the error is detected before it goes out. And if something were to slip through, traceability allows for reconstructing exactly what happened and permanently correcting the rule that caused it.

Is my data used to train the providers' models?

With enterprise contracts, no: major providers contractually commit not to train on corporate customer data and to limited retention periods. The real risk lies in the ungoverned use of free tools by employees—which is solved by providing a corporate alternative and a clear usage policy.

Does an AI agent comply with GDPR?

It can and must comply, but it doesn't do it alone: it requires data minimization, a data processing agreement with the model provider, and a record of processing activities. An agent with least privilege and full traceability puts you in a better position for an inspection than most equivalent manual processes.

Who is responsible if an agent causes damage?

The company that operates it, just as it is responsible for its employees and its software. This is precisely why governance matters: approval thresholds limit potential damage and the log demonstrates due diligence. Responsibility is not outsourced; it is governed.