From access to action: How cybersecurity changes when AI starts to act

Together with

Are your agents secure? Now that AI agents are moving from accessing systems to acting inside them, IT needs to secure different actions based on their risk level. Learn how JumpCloud helps teams implement agentic IAM and secure every identity.

When it comes to cybersecurity and AI, most of the conversations focus on what AI systems can see or ingest (think sensitive company data, customer information, proprietary IP, and other protected information).

That’s still important, of course. But AI assistants and autonomous agents add another dimension to the security problem: AI can now take action inside the business.

An AI assistant can invoke tools and interact with applications on an employee’s behalf. An autonomous agent can execute workflows without a person at the keyboard. And more advanced agents may have privileged access to infrastructure and other sensitive systems.

As AI moves from accessing information to acting on it, the security model has to account for increasing levels of autonomy and risk. Access remains foundational, but IT also needs visibility and control over what an agent can do with that access.

That requires a clear picture of the actor behind an action, whether it is operating independently or on someone’s behalf, the systems and resources it can reach, and the actions it is authorized to take. Clear ownership, activity history, and the ability to change or revoke access complete that chain of accountability.

These aren’t entirely new cybersecurity concepts. IT teams already apply versions of them to human identities. What’s changing is the actor. In partnership with JumpCloud, we looked at the progression of AI autonomy and what IT teams need to consider at each stage.

AI that’s assisting

Employees are already connecting AI assistants such as ChatGPT, Claude, and Cursor to company resources. The human is still initiating the work, but the AI tool may be calling APIs, accessing applications, or invoking tools through MCP servers on that person’s behalf. That introduces another layer between the employee identity and the resources being accessed.

IT needs visibility into that access path, including the AI tooling operating on managed devices, the connections employees establish, the credentials involved, and the applications those tools can reach. Identity tells IT who the user is; device context can provide visibility into how AI is operating in that user’s environment.

When that context is missing, shadow AI and shadow MCP can grow from an application management problem into an identity and access visibility problem.

AI that’s acting

The identity model changes when an agent begins operating independently, without a person initiating each action. At that point, the agent itself becomes the actor.

Treating an autonomous agent like a human user, hiding it behind a shared account, or relying on a long-lived API key makes attribution and lifecycle management difficult.

Autonomous agents need:

• a distinct identity
• a defined purpose
• a human owner
• appropriate application access
• lifecycle controls and activity history
• an independent way to revoke its access

Together, those controls give IT a clear chain of accountability around which agent acted, who owns it, what access it had, and how that access can be revoked without disrupting its human owner.

AI that acts with privilege

Some agents will need to perform work that goes beyond SaaS applications. Agents performing DevOps or infrastructure work may need to restart a server, connect to a production database, modify cloud infrastructure, or perform another administrative task.

Those actions already receive special treatment when humans perform them because the consequences of misuse or compromise are higher. The same rules should apply to agents.

Giving an autonomous agent permanent administrative credentials simply creates a new form of standing privilege. Instead, familiar privileged-access principles should extend to agents. Permissions should be appropriately scoped, activity should be auditable, access should be revocable, and sensitive actions should have the level of oversight that risk warrants.

This isn’t to say every agent is inherently dangerous. But the security controls should reflect what the agent is capable of doing.

The new cybersecurity conversation

IT and security teams have spent decades building controls around human behavior: authentication, least privilege, access reviews, the works. AI doesn’t make those principles obsolete, but it does change where they need to apply.

Perhaps your organization has AI assistants acting in a human context or autonomous agents with responsibilities. Or maybe even infrastructure agents performing privileged operations. All of those look like different technical scenarios, but from a security perspective, they create variations of the same fundamental problem: An actor has access to a resource and the ability to take action. So security needs to know who or what that actor is and govern what it can do.

This is the role of agentic identity and access management (IAM). Agentic IAM extends identity, access, and governance to a workforce that increasingly includes AI agents alongside humans and devices.

The goal isn’t to build an entirely separate security model for AI. It’s to extend familiar identity disciplines so organizations can consistently govern humans, devices, and agents as the workforce evolves.

In practice, that means following a cycle across four phases: discover, register, manage, and govern. IT should be able to discover what exists, register agents with clear identities and ownership, manage what they can access, and govern their activity throughout the life cycle.

As AI moves from assisting people to acting independently, cybersecurity has to follow the actor. The controls IT already relies on still apply, but they now need to account for humans, devices, and agents operating across the same environment.

See how to secure every identity—human or not.