AI Agent Rules of Engagement Must Come Before Credentials

I keep meeting teams who can tell me exactly which service account their agent authenticates with, and cannot tell me a single action that agent is forbidden to take. That gap is the whole story of agentic AI in 2026.

A credential answers who. Rules of engagement answer what you may do. Every mature high-consequence field separates the two. A pilot carries identification and a mission brief. A red team signs scope documents before a single packet moves. We built the enterprise equivalent of the ID badge, shipped it, and told ourselves governance would catch up.

It has not.

The Numbers Describe an Inversion, Not a Lag

Agent deployment has reached near-universal levels, yet only 37% of organizations enforce purpose binding and 40% maintain a kill switch. The SANS Institute’s April survey found credential hygiene deteriorating as automation accelerated past basic identity protection.

The figure I find hardest to defend: only 19% of organizations classify AI agents as equivalent to human insiders, while 44% expect malicious agent use to increase data theft. We are saying, in the same breath, that these systems are dangerous and that they do not warrant insider-grade governance.

Forrester expects at least one publicly disclosed, agent-driven breach before the end of 2026. My read is that the prediction is conservative. Most organizations lack the telemetry to notice a quiet one.

What I would change first: treat the classification decision as the governance decision. Everything downstream rotation, review, attribution — follows from whether you call the agent an insider. Teams that separate AI agent identity from human identity make that call explicitly instead of inheriting it by accident.

Least Privilege Was Never Built for Systems That Decide

Here is where I part ways with the standard playbook.

Forrester’s AEGIS governance framework argues that least privilege fails once agents act autonomously across systems, according to vice president and principal analyst Jeff Pollard, so the framework asks what decisions an agent may make rather than what access it holds. AEGIS ranks least agency, transparency, and accountability as its governing principles.

I think this reframing is the most important idea in enterprise AI security right now, and it is underrated because it sounds like a rebrand. It is not.

Consider a support agent with read-only CRM access and permission to send email. Least privilege signs off cleanly — nothing destructive, nothing privileged. Then the agent reads an account history, reasons its way to a customer-satisfaction outcome, and emails a refund commitment nobody authorized. No permission was exceeded. No control failed. The organization is simply bound by a promise it never approved.

Least privilege limits reach. Least agency limits judgment. The refund case is a judgment failure wearing a permissions costume, and no amount of access scoping catches it.

Rules of Engagement Only Count When a Machine Enforces Them

Policy documents do not govern systems that act in milliseconds. I will go further: a rule that lives only in a Confluence page is not a rule; it is a preference.

The encouraging shift is architectural. Gateway vendors now treat engagement rules as policy, evaluated inline at a policy decision point across LLM calls, MCP tool invocations, and agent-to-agent delegations — with spend and tool-call circuit breakers, rules barring PII from prompts, and obligations like requiring human approval before a wire transfer.

Issuance is tightening in parallel. The pattern I would adopt: an agent receives credentials only after its owner, purpose, tool inventory, and policy bindings enter the record, backed by scoped, revocable agent credentials rather than borrowed human sessions.

That last point deserves a blunt example. Run an agent under an employee’s session, and your audit log eventually reads Sarah deleted 40,000 records on a Tuesday when Sarah was at lunch. You have not just lost security. You have lost the ability to investigate at all.

The standards community reached the same conclusion from another direction. In an April 2026 W3C Credentials Community Group thread, a continuously running agent made the argument that cross-boundary credentials must carry behavioral constraints, not identity assertions alone. A credential that travels with its own constraints is rules of engagement, expressed cryptographically. I expect that to become the default within two years.

The Blind Spot Nobody Budgets For: Instruction Files

This is the part I raise in every review, and it lands as a surprise almost every time.

We govern what agents may access. We barely govern what agents are told. Agents load behavior at runtime from repositories and shared configuration, which means teams distributing agent skill files are shipping operating contracts through the same pipes as code, usually with a fraction of the review.

A poisoned instruction file rewrites an agent’s mandate without touching a credential. Your authorization layer stays perfectly intact while the intent layer quietly changes hands. My position: version, sign, and review instruction artifacts with production-deployment rigor, or accept that you have hardened the front door and left the orders on the doorstep.

Regulators Settled the Definition Before We Did

Agent regulations now in force treat agents as non-human identities that hold credentials and move data at machine speed, pulling human accountability rules onto them. Healthcare, finance, and critical infrastructure impose tighter oversight than horizontal AI law, regardless of company size.

The reasoning is cleaner than most internal policy I have read. An agent bundles automated decision-making, data processing, and system access into one actor, while a model only generates text. That single distinction is what turned AI tools versus agents from a marketing argument into a compliance boundary, and it came from regulators, not from security teams.

Related: AI Agents Explained: How They Think, Act, and Get Things Done