AI Agents Are Changing Enterprise Security: Why Governance Must Evolve

AI agents are moving beyond simple question-and-answer interactions.

They can read information, query databases, interact with applications and trigger API calls. That ability to take action creates new opportunities for enterprise automation, but it also introduces security challenges that traditional approaches may not fully address.

Google Cloud's latest discussion on the State of AI Infrastructure report argues that organizations need to rethink how they secure autonomous agents.

The company describes agents as "ultimate insiders" because organizations may give them permissions to access emails, databases and APIs. Unlike systems that only retrieve information, agents can use those permissions to perform actions.

The report highlights security, governance and operations as major concerns for organizations trying to scale AI infrastructure.

According to Google Cloud, 79% of technology leaders surveyed cite security, governance or operations as their most significant challenge to scaling inference.

The broader message is clear: as AI systems become more autonomous, controlling what they can access and what they can do becomes increasingly important.

The Security Challenge of Autonomous AI Agents

Traditional enterprise applications generally operate within predefined workflows.

AI agents can behave differently.

An agent may interpret a task, determine which tools it needs, retrieve information and then take an action. That dynamic behavior creates additional security considerations because the agent's access can span multiple systems.

Google Cloud identifies the central challenge as balancing access with guardrails.

An agent needs sufficient permissions to perform useful tasks. At the same time, excessive access can increase the potential impact of a compromised or manipulated agent.

The problem therefore is not simply whether an organization should give an AI agent access.

It is how that access should be controlled, monitored and governed.

The Agentic Paradox: Access vs. Security

Google Cloud describes this tension as the agentic paradox.

Agents need access to perform useful work, but that access can also expand the potential attack surface.

The report says 35% of senior IT decision-makers surveyed cite insufficient security for multi-system access as a primary issue preventing agentic deployment.

This becomes particularly important when agents interact with several enterprise systems.

An agent might need access to one system to retrieve information and another to complete an action. Managing those permissions dynamically can be difficult when security controls were designed primarily around human users and more predictable application workflows.

Google Cloud also points to emerging threats including:

• Tool poisoning

• Indirect prompt injection

• Misuse of agent permissions

• Risks associated with multi-system access

These threats can target not only the infrastructure surrounding an AI system but also the way an agent interprets and processes information.

New Threats Require a Broader Security Model

As AI agents become more autonomous, the attack surface can extend beyond conventional application vulnerabilities.

Google Cloud specifically highlights tool poisoning and indirect prompt injection.

Indirect prompt injection is particularly relevant to agentic systems because malicious instructions can potentially be embedded within information an agent processes.

Instead of directly attacking the model, an attacker may attempt to influence the agent through content it encounters while completing a task.

This creates a different security consideration from conventional application attacks.

The security question becomes not only:

"Can an attacker access the system?"

but also:

"Can untrusted information influence what an authorized agent does?"

Google Cloud says security leaders are increasingly shifting their focus toward verifying provenance and guarding against misuse, including indirect prompt injection.

Securing More Than Identity and Access

Identity and access management remain important, but Google Cloud argues that securing agentic systems requires attention across multiple layers.

The company specifically highlights:

• Identity and access

• Network security

• Model security

• Data and information provenance

• Agent behavior

• Tool interactions

• Governance

This broader view reflects the way agentic applications operate.

An agent may connect a model to enterprise data, external tools, APIs and infrastructure. A weakness in any part of that chain can potentially affect the overall workflow.

Security therefore becomes a system-level concern rather than a single product feature.

From Blocking AI to Managing AI

One of the central arguments in Google's article is that organizations cannot simply lock down autonomous systems.

Excessive restrictions could prevent agents from performing the tasks they were designed to perform.

Instead, Google Cloud says organizations are increasingly looking toward integrated, full-stack cloud platforms that provide greater oversight.

According to the report, 69% of surveyed executives rate a full-stack platform as a critical requirement, while 80% say data compliance is the primary factor influencing that choice.

These figures point to a broader enterprise concern.

Organizations are not only asking whether an AI platform can run models. They are also considering how security, governance, compliance and operational controls are integrated into the infrastructure.

Secure-by-Default AI Development

Google Cloud identifies secure-by-default design as one of three major areas for managing agentic AI risk.

The idea is to embed security into the AI development process rather than treating security as a final step.

This approach is intended to help organizations address threats such as prompt injection earlier in the development lifecycle.

For enterprises, this can mean considering security controls while designing agent workflows, defining permissions and connecting tools rather than waiting until an agent is already deployed.

This is an editorial implication of Google's described approach, not a separate finding from the report.

Agent Governance and Oversight

The second area highlighted by Google Cloud is agent governance and oversight.

As organizations deploy more agents, they need ways to understand:

• Which agents exist

• What those agents are allowed to access

• Which tools they can use

• What actions they can perform

• How their interactions are monitored

Purpose-built identity and permission management can provide greater visibility into these interactions.

Google Cloud's argument is that agent governance should be designed around the behavior and requirements of AI agents rather than simply extending existing human-access models.

This can help organizations identify blind spots and limit unnecessary access.

Human-in-the-Loop Controls

The third area is human-in-the-loop control.

Not every action performed by an agent needs human intervention.

However, some actions may carry enough business, security or operational impact to require explicit approval.

Google Cloud recommends establishing rules that can identify situations where an agent should stop and request human approval before continuing.

This creates a middle ground between two extremes:

Fully manual workflows

and

Unrestricted autonomous execution

The goal is governed automation, where agents can operate independently within defined boundaries while humans retain control over critical decisions.

Why Agent Governance Is Becoming Infrastructure

The development of autonomous AI changes the role of security infrastructure.

In traditional applications, organizations can often define relatively predictable access paths and workflows.

Agentic systems introduce more dynamic interactions.

An agent may determine which information to retrieve, which tool to use and what action to take based on the task and the information it encounters.

That makes governance increasingly important.

Identity, permissions, monitoring, policy enforcement and human approval mechanisms need to operate alongside the AI infrastructure itself.

Google Cloud's argument is that governance should therefore become part of the foundation supporting agentic applications.

A Central Control Plane for Agentic AI

Google Cloud says organizations are increasingly looking toward a central control plane to manage agent-related risks.

The company points to frameworks such as the Secure AI Framework (SAIF) and purpose-built platforms such as Gemini Enterprise Agent Platform as examples of approaches designed to bring security and governance into the broader AI infrastructure.

The objective is to provide organizations with a more unified way to manage agent identity, permissions, interactions and security controls.

This approach also reflects a larger movement toward treating AI agents as enterprise infrastructure rather than isolated experiments.

What This Means for Enterprise Security Teams

The discussion highlights a broader industry shift toward security models designed specifically for autonomous software.

For security teams, the challenge is increasingly about understanding not just who has access, but what an AI agent can do with that access.

For infrastructure teams, this means considering agent identity, permissions, telemetry and policy enforcement as part of the deployment architecture.

For developers, security considerations increasingly need to be incorporated into agent design and tool integrations.

For business leaders, governance and data compliance are becoming important factors when selecting AI infrastructure.

These are editorial implications of the capabilities and survey findings described by Google Cloud. They should not be interpreted as independent Gartner findings or as guarantees about any particular platform.

The Shift From AI Experiments to Governed Agentic Systems

The evolution of enterprise AI can increasingly be viewed as a progression:

AI Models

↓

AI Applications

↓

AI Agents

↓

Agents With Enterprise Access

↓

Governed Autonomous Workflows

Each stage introduces additional capabilities.

It can also introduce additional security considerations.

The more systems an agent can access and the more actions it can perform, the more important identity, permissions, monitoring and governance become.

This is why security is moving closer to the core of agentic infrastructure.

What Google's State of AI Infrastructure Discussion Highlights

The Bigger Picture

AI agents are changing the relationship between software and enterprise systems.

Instead of simply presenting information to users, agents can retrieve data, interact with tools and initiate actions.

That capability is central to their value, but it also creates a new security challenge.

Organizations need to give agents enough access to be useful without giving them uncontrolled authority.

Google Cloud's latest State of AI Infrastructure discussion frames this challenge around three principles:

Secure by default.

Govern the agent.

Keep humans involved when critical decisions require approval.

The broader industry shift is therefore not simply toward more autonomous AI.

It is toward governed autonomy.

As enterprises move more AI agents into business-critical workflows, security and governance are likely to become increasingly important parts of the infrastructure supporting them.