Controlling AI Agent Access and Accountability With Ekco

What happens when an AI agent pursues an approved task in a way nobody expected, using access that reaches further than it needs?

On Tech Talks Daily, I'm joined by Jonathan Trayers, a director at Ekco, to discuss the security decisions behind agentic AI. The conversation focuses on what changes when a system can act with credentials, connect to business applications, and trigger workflows. A useful answer in a chat window and an automated action inside a company create different responsibilities.

Jonathan describes working with both deterministic workflows, where rules specify what should happen, and agentic steps, where AI interprets a situation before deciding what to do. Bringing those approaches together raises practical questions about boundaries. Which actions can the system take, what information can it access, and where should a person remain involved?

What interested me was his emphasis on limiting the impact of unexpected behavior. Predicting every failure is unrealistic, so he argues for reducing the area an agent can affect. The permissions attached to its identity help determine that boundary. An agent given broad access may be able to create problems across several systems, even when its original assignment sounds narrow and reasonable.

We discuss separate identities for agents and their connections, restricted permissions, continuing monitoring, and the ability to revoke access. Jonathan also describes governance as a series of practical decisions about the use case, the risks the business accepts, and the people responsible for approving the deployment. Prompts can express instructions, while controls around the systems an agent reaches need their own attention.

Testing is another part of that process. Jonathan recommends beginning in a controlled environment, observing the outcome, and then using supervised operation before handing over greater responsibility. His invoice example makes the point understandable. Processing an invoice and authorizing its payment involve different consequences, so the workflow should reflect that difference rather than giving one automated process every permission at once.

We also consider what this means for smaller businesses. Jonathan's concern is that companies with limited security resources may already have broad access arrangements, which can be carried into AI deployments. Company size alone does not determine exposure, but understanding accounts, permissions, software, and patching remains part of managing it. His argument is to apply those disciplines as AI adoption develops, rather than waiting for a new platform to solve every governance problem.

Accountability runs through the discussion. Jonathan argues that a business remains responsible for the way it deploys technology and approves access, alongside responsibilities held by vendors and model providers. The precise legal allocation will depend on the circumstances. The operational question for listeners is clearer: who owns the use case, who accepted its risks, and who can act when something changes?

For teams beginning this work, Jonathan recommends one valuable use case and a reusable implementation pattern. Define the boundaries, test the controls, retain human judgment where needed, and use the experience to inform the next deployment. The conversation offers a practical starting point for organizations trying to gain value from AI agents while keeping their access and actions understandable.

Please share your thoughts. How is your organization deciding what AI agents may do, and what would help you keep ownership, permissions, and oversight clear after deployment?