# Identity and Permissions Fall Short for AI Agent Security, Box CISO Argues
Traditional access controls and permissions frameworks are insufficient to govern autonomous AI agents in enterprise environments, according to Heather Ceylan, chief information security officer at Box. The security gap centers on a fundamental mismatch: legacy permission systems control what agents can reach, not how they behave once deployed.
An autonomous agent with legitimate access to enterprise data can execute unintended actions within seconds. A system that grants an AI sales agent access to customer databases might inadvertently allow it to modify records, send unauthorized communications, or extract sensitive information in ways no human would intend. Traditional identity and access management (IAM) tools lack the behavioral guardrails needed to constrain agent execution after access is granted.
This realization is reshaping enterprise AI security architecture. Organizations must move beyond the foundational layer of access control toward a layered defense model that governs execution alongside access. Ceylan emphasizes that permissions remain foundational but must be reimagined for AI-specific workloads.
"Access controls and permissions were designed for humans," Ceylan told VentureBeat. "Permissions are still the foundation, but you have to think about how the agents get their permissions scoped as well."
The distinction matters operationally. A human employee accessing a customer database follows implicit behavioral rules governed by job function, compliance training, and social consequences. An AI agent has no such constraints. It executes instructions literally and at machine speed. If instructed to "resolve customer issues," an unconstrained agent might refund entire accounts, modify contracts, or escalate internal escalation protocols without review.
Box, the enterprise content management platform, is flagging this gap as AI adoption accelerates across sales, customer service, and operations teams. The company positions security governance as a competitive requirement for vendors deploying agentic workflows. Without execution controls, enterprises face expanded liability, data leakage, and operational chaos.
The shift reflects broader tensions in enterprise AI deployment. Companies rushing to build agents for productivity gains often treat security as a downstream problem. Early AI agent frameworks from OpenAI, Anthropic, and others focus on capability and reasoning rather than behavioral constraints. Vendors addressing this gap include emerging security-focused AI platforms and traditional IAM providers bolting execution monitoring onto existing solutions.
Ceylan's comments from Box suggest the enterprise security landscape will fragment into tiers. Tier one remains traditional IAM: roles, permissions, directory services. Tier two introduces agent-specific controls: action auditing, behavior anomaly detection, scope limiting, output validation, and execution policies that constrain what agents can do with their access. Tier three might include agentic reasoning oversight, confidence thresholds, and human-in-the-loop approval for high-risk actions.
This layered approach mirrors how cloud security evolved. Organizations first secured network access, then added workload identity, then workload behavior monitoring. AI agent governance follows the same pattern but compresses the timeline.
Enterprise buyers will increasingly demand these controls from AI platform vendors and security tool providers. Companies unable to articulate governance strategies beyond permissions will face procurement friction. Box and competitors must demonstrate that AI agents operate within defined behavioral boundaries, not just authorized data access paths.