When AI Agents Stay Within Their Permissions and Still Go Wrong
September 25, 2026 · Keith Pasley
AI agents can have the right identity and the right permissions and still do something they shouldn’t.
That is what caught my attention about Abnormal AI’s latest Agent Security announcement.
The approach connects an agent to its identities, systems, permissions and resources, then looks for changes in behavior.
I think that distinction is important.
Imagine an agent that legitimately has access to customer records. One day it starts retrieving far more records than usual, accessing systems it rarely touches or taking actions that don’t make sense for the job it was assigned.
Authentication worked.
The permissions were valid.
Nothing necessarily failed at the identity layer.
The behavior changed.
We’ve dealt with this problem for years with human users. A valid credential doesn’t automatically mean the activity behind it is legitimate.
Agents make that problem more complicated because changing their behavior is part of what makes them useful.
They reason. They choose tools. They try different approaches when something doesn’t work. They can operate for long periods without a human making every decision.
So I don’t think agent security can stop at identity and access.
We need to know who the agent is and what it is allowed to do.
But we also need enough context to recognize when what it is actually doing no longer makes sense.
That creates several layers of control.
Identity establishes who the agent is. Authorization defines what it can access. Context influences the decisions it makes. Runtime controls establish boundaries. Behavior tells us whether its actions still make sense for the job it was given.
Those signals need to work together.
As enterprises give agents more autonomy, I think behavioral monitoring will become just as important for non-human identities as it already is for human ones.
Why this matters: A compromised or misbehaving agent may never violate its formal permissions.
Decision it changes: When evaluating agent security, I would ask how abnormal behavior is detected after legitimate access has already been granted.
Who should care: CISOs, IAM leaders, enterprise architects, AI platform teams and AI governance leaders.
What I would ask next: If one of your AI agents started behaving differently tomorrow while staying completely inside its permissions, would your security architecture know?