By: Dr Charalambos Theodorou, Founder & CEO of Xybern

Artificial intelligence is entering a new phase. For the past several years, much of the discussion around AI has focused on systems that generate content, answer questions, write code or assist people with decision making. That model is now evolving.

The next generation of AI systems will increasingly be able to take actions. Autonomous AI agents can interact with applications, call tools, access systems, trigger workflows and perform tasks with far less direct human involvement than traditional software. This creates significant opportunities for businesses, but it also changes the security problem.

The key question is no longer only whether an AI system can access a resource, but what that system is actually authorized to do once access has been granted. That distinction is becoming increasingly important.

Traditional cybersecurity and access control systems were largely designed around human users, applications and relatively predictable machine identities. These systems typically determine whether an identity is permitted to access a particular resource. Autonomous AI introduces a different operating model.

An AI agent may be given a broad objective, reason about how to achieve it, select between multiple tools, interact with several systems and potentially initiate downstream actions. In that environment, access alone does not define appropriate authority.

An agent may legitimately need access to a system while only being permitted to perform a narrow set of actions within it. For example, an autonomous system might be allowed to retrieve information but not modify it. It may be permitted to perform routine actions within defined operational limits while requiring human approval before executing an action with greater financial, security or operational consequences.

This creates a need for more precise authorization.

From Identity to Authority

Identity remains essential. Organizations need to know which human, application or AI agent is requesting access to a system. But identity and authorization solve different problems: identity establishes who or what is making the request, while authorization determines what that identity is permitted to do.

As AI systems become increasingly autonomous, the second question becomes significantly more complex. Knowing that an AI agent is trusted does not mean that every action the agent is technically capable of performing should automatically be permitted.

Autonomous systems therefore require clearly defined operational boundaries. These boundaries may depend on factors such as the requesting agent, the action being attempted, the resource involved, the context in which the request occurs and the policies established by the organization.

The principle should be straightforward: an AI agent should not be able to perform an action merely because it has technical access to the system capable of executing it. The action itself should be authorized.

Why This Matters for High-Consequence Industries

The need for precise authorization becomes particularly important in regulated and high consequence environments. Cybersecurity, government, defence, financial services and healthcare are examples of sectors where autonomous systems may eventually interact with sensitive information, privileged systems, critical infrastructure or consequential operational workflows.

In these environments, an unauthorized action can create consequences far beyond an incorrect AI generated response. There is a fundamental difference between an AI assistant producing an inaccurate paragraph and an autonomous system executing an unauthorized action against a production environment.

As businesses begin deploying AI agents into operational environments, they will need to determine not only what these systems can technically do, but what they should be allowed to do. That means defining clear authority boundaries before actions are executed.

Human Approval Should Be Deliberate, Not Universal

One response to autonomous AI risk is to require a human to approve every action. That may provide reassurance, but it also removes much of the efficiency and value that autonomy is intended to create.

The objective should not be to place a human in front of every decision. Instead, organizations should determine where autonomous authority is appropriate and where human authority should remain mandatory.

Low consequence, routine actions may be permitted automatically within clearly defined limits, while more sensitive actions may require additional conditions or explicit human approval. The important point is that these boundaries should be deliberate, enforceable and aligned with the organization’s risk tolerance.

Autonomy should therefore exist within authority, rather than outside it.

Security Infrastructure Must Evolve Alongside AI

The rapid development of AI capabilities has understandably received significant attention. However, the infrastructure surrounding those capabilities will be equally important.

Businesses cannot treat autonomous AI as simply another application added to the existing technology stack. As AI systems gain greater ability to make decisions and execute actions, organizations will need infrastructure specifically designed to control the authority delegated to those systems.

This is likely to become particularly important as enterprises move from experimental AI projects into production deployments involving real systems, real permissions and real operational consequences. The security architecture around autonomous AI must evolve at the same pace as the AI itself.

The Next Layer of Enterprise Security

The development of identity and access management provides a useful comparison. As organizations became increasingly digital, it became essential to control which users and applications could access which systems. Today, identity infrastructure is considered a foundational part of enterprise cybersecurity.

Autonomous AI is likely to create a similar requirement around authority. Organizations will need mechanisms that allow them to define what autonomous systems are permitted to do, under which conditions and within which boundaries.

This is the area Xybern is focused on. Xybern is a cybersecurity company focused on agentic security, building authorization infrastructure for autonomous AI. Our work is centered on one specific problem: enabling organizations to control what AI agents are permitted to do before actions are executed.

The broader objective is not to reduce autonomy, but to make autonomy deployable in environments where security, control and clearly defined authority matter.

The future of AI will not only be determined by how intelligent these systems become, but by how effectively organizations control the authority they give them.

Autonomy should never mean unlimited authority.