The Agent Authority Chart: What Real Agentic AI Governance Looks Like

An AI agent at Meta passed every identity check the company owned. Valid login. Cleared boundaries. Every box ticked. It still spent close to two hours showing private project files to employees who had no business seeing them.

Meta confirmed the incident on March 18. Its own words are the part I keep coming back to. The agent "held valid credentials, operated inside authorized boundaries, passing every identity check." Security researchers call this a confused-deputy failure. A system that's fully logged in does something nobody actually approved. The tools built to catch bad actors have nothing to say about it. Technically, nobody broke in.

I ran a $1.1B innovation portfolio across 14 countries at Cisco. Permissions were never the part that kept me up. Authority was. Those are two different questions. Most companies still answer only the first one. Permissions ask what a system's login can technically reach. Authority asks who is allowed to approve it reaching there. Meta had airtight permissions. Nobody had assigned who could approve what that specific agent was doing. When it acted inside its own boundaries, no human checkpoint was left to catch it.

Meta isn't the only one. Saviynt's 2026 CISO report surveyed 235 security leaders. 47% had already watched an AI agent do something nobody approved. Only 5% felt sure they could stop a compromised agent if it happened tomorrow. The Cloud Security Alliance found something just as blunt. 92% of security teams don't trust their current tools to manage AI agents at all. These aren't small numbers from a niche poll. Almost half of security leaders have already watched an agent go off-script. Almost none of them trust the tools meant to stop it.

VentureBeat's read on the Meta case names four specific gaps. Every one describes a company that built the tech faster than it built the org chart around it. Most companies can't say, right now, which agents are even running. New agents inherit access nobody tracked, and nobody notices. Most agent keys never expire. A stolen key stays live forever instead of timing out like a normal login should. Almost nobody checks whether a logged-in action still matches what the agent was actually asked to do. A valid login can still do something nobody meant to allow. And when one agent hands work to another agent, that handoff usually carries no check at all. Trust passes down the chain with nobody watching each step.

Here's what I mean by authority, in practice. An agent that books a meeting and an agent that can move money carry different risk. They shouldn't report to the same level of oversight. A working governance framework weighs what an agent can actually do, not just what department built it. The agent that only schedules things needs light oversight. The agent that can move a dollar or touch a customer record needs a named human who signed off on that capability before it went live. Not a security team that finds out later, from an incident report.

Gartner's read on where this is heading backs up the urgency. The firm projects more than 40% of agentic AI projects will be canceled by the end of 2027. It points to cost, unclear value, and weak risk controls, not weak models. Companies aren't walking away because the technology fails. They're walking away because nobody built the authority structure the technology needed to run safely. Cleaning that up after a Meta-style incident costs more than building it right would have cost first.

I think about this the way I think about every technology wave that outran its own infrastructure. The printing press spread across Europe for decades before anyone built copyright law around it. The capability arrived first. The rules arrived only after enough damage had already been done to force the question. Agentic AI is living through that same gap right now. Companies still waiting for a Meta-scale incident to force their hand are choosing to learn the expensive way.

Draft the authority chart before you expand what any agent is allowed to do next. Name, in writing, which class of decision needs a human signature. Do it before the agent goes live. Your security team shouldn't have to piece it together from logs afterward. That's the human-plus-agents stack, done right. Judgment stays with a named person, not a checkbox that already said yes.

Who in your company signs off on what your agents are allowed to do this week? If you can't answer that in the next meeting, that's the gap Meta found the hard way.

Sources: VentureBeat, March 2026 (Meta incident, IAM governance gaps) · Saviynt CISO AI Risk Report 2026 (235 respondents) · Cloud Security Alliance, 2026 · Gartner, June 2025.

Alex built agent-authority frameworks like this one while running a $1.1B innovation portfolio at Cisco.

book a conversation →