AI agents keep access to company data after their work is done
Delinea's 2026 report finds AI agents often retain company data access after tasks, with weak real-time enforcement and traceability.
Delinea's 2026 Identity Security Report, The AI Enforcement Gap, says 99.7% of IT and security leaders have a formal policy on data AI tools and agents may access, yet many reported or suspected over-access in the past year. About 51% check access against policy in real time, fewer than one in five detected the latest out-of-scope access as it happened, and 42% have no automatic revocation when a session ends. Seventy-six percent of employees said they bypassed approval, and only 36% of IT respondents could always trace sensitive AI access to the person who authorized it. Agents often inherit long-accumulated user permissions and may keep reaching customer, employee, financial, log, and source-code data after a task ends.
- 99.7% report a formal AI data-access policy, but enforcement and visibility lag.
- Only 51% check AI access in real time; under 20% caught the latest over-access live.
- 42% cannot automatically revoke AI access when a session ends.
- 76% of employees bypassed approval; only 36% of IT can always trace authorization.
- Agents inherit accumulated user privileges and may retain access to sensitive company data.
From the original article
3 min read at helpnetsecurity.com
IT teams responsible for identity security are concerned about AI agents’ ongoing access to company systems and the actions they take on users’ behalf, according to a Delinea’s 2026 Identity Security Report: The AI Enforcement Gap. “Written policy is only as good as your ability to enforce it at the moment an AI agent acts,” said Art Gilliland, CEO of Delinea.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.