Presented by NTT DATA AIVista
VentureBeat’s June research revealed that 69% of enterprises continue to operate AI agents that share credentials, a practice linked to increased security incidents and near-incidents.
At the VB Transform 2026 event, Mukesh Karki, CTO of NTT DATA AIVista, and Mayank Upadhyay, chief security and trust officer at Snowflake, emphasized that addressing identity issues is merely the initial step. For the safe deployment of autonomous systems at scale, enterprises must incorporate action-level authorization and tamper-resistant audit trails into every agent interaction.
“Organizations need to demonstrate to their auditors in a highly tamper-resistant manner that the records they present truly reflect their activities,” Karki stated. “Provability is essentially your license to operate within a regulated environment.”
Why Shared Credentials Lead to AI Security Incidents
According to Upadhyay, many assumptions from an older generation of software persist.
“In traditional software, a human clicks and the software performs a predictable action, and you know which API it will call,” he explained. “However, in the agentic world, software has a mind of its own and continuously rewires itself. If you grant this software more permissions than necessary, agents—being naturally exploratory—will attempt various actions, leading to unintended side effects.”
Embedding a single static API key increases vulnerability, he further noted.
“It’s problematic if you have one API key embedded in the agent, allowing it to interact with a SaaS service on behalf of anyone, as this effectively grants the agent the combined needs of all users,” he said, highlighting that the second issue is forensic in nature, as “errors may occur, and you won’t be able to attribute them to the correct agent.”
Scoped Credentials Are Just the Beginning for Regulated Industries
Karki, who primarily serves clients in insurance, healthcare, and finance, considers scoped credentials as essential.
“In a regulatory context, an agent with broadly scoped credentials cannot operate,” Karki asserted. “Scoped credentials are merely a starting point. There are two layers of constraints: the jurisdiction where the agent operates and the rules of the organization.”
For example, a claims adjustment agent in Washington State operates under different regulations compared to one in California, he explained, with each claim being unique.
“Scoped credentials alone are insufficient, as actions must be governed by specific rules at the time they are taken,” he added.
Limitations of the Employee Analogy for AI Agents
Karki argued that the employee analogy only partially applies. Agents must learn an organization’s unique context, similar to a new employee. However, unlike people, enterprises cannot realistically build trust with thousands of agents over time.
“A star employee in one organization might not excel in another, not because of diminished skills, but due to a lack of context in the new environment, and this is true for agents as well,” Karki explained. “If each employee manages 100 agents, you cannot feasibly onboard and vet all of them.”
Upadhyay suggested that the employee analogy should rank agents lower in the organizational hierarchy.
“Treat them like interns,” he advised. “They mean well but don’t always know what they’re doing, so you need to supervise them while gradually building trust.”
On the Snowflake platform, administrators can enforce platform-wide safeguards like read-only operations, while developers can further restrict an agent’s permissions when initiating each session.
A Three-Layer Approach to AI Agent Governance
According to Karki, governance should be applied to every agent action and positioned outside the agent.
“This is the only way to later prove that the agent took an action it was authorized to take,” he explained.
Upadhyay divided governance into three layers:
The agent layer involves identity, tool permissions, and MCP governance.
The model layer tackles indirect prompt injection and enables models to run within the customer’s VPC, keeping prompts hidden from the model provider.
The data layer involves least-privilege access, zero-copy architecture, and role-based access control.
Effective governance necessitates integration across all three layers.
Initial Steps for Enterprise Audits
For enterprises reviewing the governance of existing AI agents, Upadhyay recommends starting with two areas: auditing permissions for static secrets, which is the most significant fixable attack vector, and addressing shadow AI through an MCP gateway, eliminating the need for developers to operate unauthorized open-source MCP servers under their desks and providing administrators insight into MCP server interactions.
The balance between constraint and capability can be managed at the task level, utilizing confidence scoring to restrict autonomous execution on high-risk actions, with sandboxing as a compromise. However, Karki advises caution for enterprises already scaling their agentic systems.
“Much of this cannot be retrofitted after an agentic system is operational, and it’s even harder to retrofit if you need to justify to auditors why an agent acted as it did,” he pointed out. “Provability must be built from the ground up during system design.”
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.
