Controlling AI Agent Access and Accountability With Ekco

What happens when an AI agent pursues an approved task in a way nobody expected, using access that reaches further than it needs?

On Tech Talks Daily, I'm joined by Jonathan Trayers, a director at Ekco, to discuss the security decisions behind agentic AI. The conversation focuses on what changes when a system can act with credentials, connect to business applications, and trigger workflows. A useful answer in a chat window and an automated action inside a company create different responsibilities.

Jonathan describes working with both deterministic workflows, where rules specify what should happen, and agentic steps, where AI interprets a situation before deciding what to do. Bringing those approaches together raises practical questions about boundaries. Which actions can the system take, what information can it access, and where should a person remain involved?

What interested me was his emphasis on limiting the impact of unexpected behavior. Predicting every failure is unrealistic, so he argues for reducing the area an agent can affect. The permissions attached to its identity help determine that boundary. An agent given broad access may be able to create problems across several systems, even when its original assignment sounds narrow and reasonable.

We discuss separate identities for agents and their connections, restricted permissions, continuing monitoring, and the ability to revoke access. Jonathan also describes governance as a series of practical decisions about the use case, the risks the business accepts, and the people responsible for approving the deployment. Prompts can express instructions, while controls around the systems an agent reaches need their own attention.

Testing is another part of that process. Jonathan recommends beginning in a controlled environment, observing the outcome, and then using supervised operation before handing over greater responsibility. His invoice example makes the point understandable. Processing an invoice and authorizing its payment involve different consequences, so the workflow should reflect that difference rather than giving one automated process every permission at once.

We also consider what this means for smaller businesses. Jonathan's concern is that companies with limited security resources may already have broad access arrangements, which can be carried into AI deployments. Company size alone does not determine exposure, but understanding accounts, permissions, software, and patching remains par