7:40 a.m. Legal forwards you an email. A file of customer records went to an outside address on Friday afternoon. The sender was one of your engineers.
8:15 a.m. You pull the logs.
- Valid login
- MFA passed
- Approved app
As far as your systems can tell, the engineer did it.
10:00 a.m. The engineer swears they didn’t. A few weeks ago, they connected an AI agent to their email to help manage their inbox. They never told it to send anything.
12:00 p.m. The board wants to know who authorized it. If those records hold personal data, the audit trail and possible sanctions just became very real.
The banks are already there
This is what many of the biggest banks in the country are facing right now. AI agents are working inside customer accounts, usually logged in with the customers’ own passwords. Axios reported in October that many of those banks:
“are broadly not able to parse whether agent account activity is user-directed.”
One agent called a bank and filed a complaint without checking with the customer first. One bank executive said they struggle to tell an agent the customer authorized from one that has “gone rogue.”
These are banks with some of the most sophisticated security programs in the world, and they still cannot tell an agent acting on instruction from one acting outside the scope it was given.
Your controls see a valid user
Bank executives are especially worried about agents a customer has given “purchase authority or the ability to shift funds,” Axios reported.
Your employees might be doing exactly what those bank customers did: connecting AI tools to their work. Often that means personal ChatGPT accounts on company laptops, which carry none of the company’s guardrails.
At one large manufacturer, engineers were using AI tools on their personal accounts to get work done faster while the official rollout worked its way through approvals. The security team had a sense it was happening but had no way to see it.
Your controls check whether this is the right person and whether MFA passed. They never ask whether that person told the agent to do this, or whether the action was part of the request.
It’s not just files
At a financial services firm, an agent in testing kept relaunching itself dozens of times, and the team had no clean way to shut it off. That isn’t rare. In an ISACA survey of more than 3,400 IT audit, security and governance professionals, 56% said they don’t know how quickly they could shut down an AI system after a security incident.
An agent can do anything the employee it acts for can do. If it misreads a task or takes an extra step, nothing stops it, because it’s signed in as the employee. “Summarize this week’s invoices” could end with a payment approved. “Clean up the test database” could end with production data deleted.
It lands on you
In August, a federal appeals court found that when Perplexity’s shopping agent used Amazon for a customer, “it is the user who ‘accesses’ Amazon’s computers,” not the company that built the agent, MediaPost reported.
JPMorgan CEO Jamie Dimon put it plainly on the Oct. 13 earnings call:
“They should understand there’s a liability transfer.”
Companies have already tried arguing that the AI did it. When Air Canada told a tribunal its chatbot was responsible for its own actions, the tribunal rejected the argument and held the airline liable, as the American Bar Association noted.
Inside your company, the user is your employee. Whatever their agent does is logged as something your employee did, on your systems.
You can’t prove what happened
Regulators already see the problem. In January, FINRA warned that AI “agents may act beyond the user’s actual or intended scope and authority,” and that multi-step agent tasks “can make outcomes difficult to trace or explain, complicating auditability.”
Most companies aren’t ready for that conversation. Fewer than half of security and governance professionals (43%) are highly confident their organization could investigate a serious AI incident and explain it to leadership or regulators, according to the same ISACA survey. More than a quarter have little or no confidence.
Try it yourself: pick any action an agent took in your environment yesterday and see whether you can trace it back to an instruction.
Without that record, the investigation stalls:
- Your employee says they didn’t do it.
- Your logs say they did.
- The regulator’s clock is already running.
About 1 in 5 organizations reported a breach involving AI this year, according to IBM’s 2026 Cost of a Data Breach report. Almost all of them (92%) hadn’t put proper controls on who and what could access their AI.
Several banks responded by restricting or blocking outside agents. You can’t block your own people from using agents to do their jobs.
Proving control
Your security program already knows who logged in. For most companies, the gaps come after that: seeing which agents are connected, stopping the wrong actions, and proving what happened. Alterion gives you:
- See: every agent your employees have connected, approved or not
- Stop: each action is checked before it runs, and the ones that break your policy are blocked
- Prove: a record of what each agent was asked to do and what it did, ready for the board and the regulator
It runs inside your own environment, so your data never leaves it. It works without changing a line of agent code.
So the next time legal forwards that email at 7:40 on a Monday, you open the record. You see what the agent was asked to do, what it tried to do, and that it was stopped before the file left, because sending customer records outside broke your policy.
