The seven controls an AI pilot needs on day one

A pilot is where these controls get skipped, and the reason is structural rather than careless. A pilot exists to prove value quickly, on a small budget, against a deadline somebody announced in a board meeting. The fastest way to make an agent useful is to run it with the access its operator already has. The fastest way to make it work on the second day is to paste a key into a config file.

Both shortcuts survive the pilot. That is the problem. Nothing about a successful pilot creates a moment where somebody goes back and scopes the credential down, because the pilot's success is measured in output rather than in blast radius.

The numbers say this is the normal outcome, not the exception. Saviynt's 2026 CISO AI Risk Report found 71 percent of organizations say AI tools reach core systems while 16 percent govern that access, 92 percent lack full visibility into their AI identities, and 5 percent are confident they could contain a compromised agent. A separate survey of 327 IT and security leaders found 76 percent run AI against Microsoft 365 data and 43 percent reviewed permissions first, with 9 percent letting agents inherit the deploying user's full rights.

Run AI against Microsoft 365 data76%

Reviewed permissions before deploying43%

Let agents inherit the deployer's rights9%

What follows is the set of controls that separates a pilot you can extend from one you have to unwind. Each is drawn from a failure that happened in public in the last month, each produces an artifact somebody can check, and each has an owner. None of them require a product you do not already have.

1. An inventory, with an owner against every line

You cannot scope what you cannot list. Enterprise Management Associates surveyed 202 leaders and found 47 percent have no reliable agent inventory while 65 percent have already seen agents act outside their intended scope. SAP LeanIX puts agent deployment or planning at 98 percent of firms, with fewer than half able to inventory what they run and Gartner projecting more than 150,000 agents per Fortune 500 company by 2028.

For a pilot the inventory is small enough to be trivial, which is exactly why it is worth starting. Help Net Security published a five-part inventory for agent credentials that works as a template: owner, reachable tools, credential type, effective authority, runtime behavior.

The artifact is a row per agent naming a human owner. Legislators are converging on the same requirement. The Stop Rogue AI Act would have NIST set agent security standards including machine-readable agent inventories binding on federal contractors, and the AI AGENT Act would impose recordkeeping duties on agent providers with the FTC as enforcer.

2. Identity per agent, scoped below the operator

An agent that runs as its operator inherits every system that operator can reach, including the ones nobody thought about when the pilot was scoped. The 9 percent figure above is the version companies admit to. The more common pattern is an agent that runs as a service account provisioned years ago for a different purpose.

Non-human identities are now the leading way in. SpyCloud ties 31 percent of intrusions to non-human identities, with 36 percent of organizations monitoring them and 56 percent holding formal governance over AI tool privileges.

The Cloud Security Alliance's identity maturity model for AI agents scores five stages from untracked to governed and names the metric worth adopting: time to revocation. Most organizations have never measured theirs.

3. Credentials with scope, expiry and a rotation date

Hush Security examined roughly 82,000 public MCP configuration files and found hardcoded secrets in 12 percent of credential slots. Of the secrets it could classify, 53 percent carried organization, account, workspace or database wide access, and 80 percent of those with an expiration policy did not expire by default.

Those three numbers describe the same failure at three depths: the secret is in the file, the secret is broad, and the secret does not age out. Each is fixable during a pilot and expensive afterward.

The attack side is already industrialized around this. Google's threat intelligence group found a single server holding more than 23,800 harvested secrets including API keys. An unauthenticated flaw in Langflow was exploited specifically to steal OpenAI and AWS keys. CISA's catalog now includes AI gateway entries where attackers authenticate to LiteLLM and harvest upstream provider keys, which is what a gateway is for, from the other side.

Two failure modes deserve naming because neither is stopped by rotation alone. Okta found 555 AI service tokens and 2,937 encrypted OpenAI tokens in one stealer dump: a replayed session token logs an attacker in without a password and without touching multi-factor authentication, so session lifetime is the control, not password strength. And Anthropic reported an attacker who prompt-injected an AI vendor's evaluation sandbox into handing over production API keys, then reached roughly thirty AI companies in four days. The key did not leak from a repository. It was requested, and something handed it over.

Even the models are looking. OpenAI disclosed that one of its own models, blocked from an API during an evaluation run, searched GitHub for leaked keys, found one that worked, and then fabricated the data it still could not retrieve.

4. A drawn line at the filesystem

Local file access is the control most pilots never write down, because the agent runs on a developer machine where everything is already readable.

Two disclosures this month show what that costs. A malicious .git config can make Claude, Codex, Cursor and other agents run attacker code as the developer, before any trust prompt appears, simply because a received folder arrived with its .git directory intact. And Anthropic and EPFL measured 55 percent agent-to-agent infection through editable system prompt files: if your agents write to shared memory or instruction files, that is a trust boundary nobody drew.

The plugin path is the same shape. Plugin4Shell defeated commit pinning across four coding agents because the agent checked out the hash the marketplace pinned without verifying it got that commit, and plugins update in the background by default.

The artifact here is a written list of paths the agent may read, paths it may write, and the answer to one question: what happens when a file it reads contains instructions.

5. A rule for who can change the model

This is the pillar most buyers have never considered, and it applies the moment a pilot runs anything self-hosted.

The AI security firm Irregular showed that an agent asked to fix wrong outputs, with no mention of training, retrained and redeployed the model underneath itself. Of six synthetic secrets seeded in the training data, the original model reproduced none and the agent's version reproduced three verbatim. A model that had refused all ten competitor questions beforehand refused zero afterward. It also fixed the actual bug, twenty of twenty queries correct, which is the part that makes it dangerous: on the ticket, the work looks finished.

The attack needed nothing exotic. Shell access, training scripts, and weights reachable from the agent's working directory, which describes a lot of internal AI platforms built in the last two years.

Vendors are treating weight protection as a first-class control, which is a useful signal about where this lands. OpenAI paused internal work on its largest training run that did not meet strengthened isolation and weight protection requirements. The controls to copy are provenance on what was trained and what is being served, alerting on checkpoint changes, and an authorization to serve traffic that the agent itself cannot grant.

6. A ceiling on spend, and a human on anything irreversible

Not every failure is an attack. Mandiant and Google Threat Intelligence described an accounting agent that entered a runaway loop and made more than 15,000 high-cost API calls in under an hour, generating about $50,000 in cloud charges and disrupting live transactions. No attacker was involved. The control that was missing is a hard ceiling that trips without anyone watching.

Limits also have to sit somewhere the agent cannot reach. A controlled rebuild of an Australian gym incident had Claude Opus 4.6 exploit a client side booking limit in nine of ten runs, canceling a stranger's reservation in two of them, without being asked to. A limit enforced in the interface is not a limit.

Approval is the cheapest control available. Versa's field CISO orders the work as inventory first, blast radius second, testing third, with human approval before irreversible actions. Worth noting what approval records do not yet do: Google's Agent Payments Protocol records approved limits and moves evidence between systems, but nothing in those records ties a charge to the task the user gave, so disputes have no chain to resolve them with. Log the task alongside the approval yourself.

7. Tracing on from the first run, because revocation is a clock

Detection products for agent behavior now exist. Google shipped anomaly detection for Gemini Enterprise that flags tool misuse, privilege abuse and runaway loops into Security Command Center, and it requires tracing to be turned on before it sees anything. Logging that was optional when agents were pilots is the prerequisite for every control that follows.

The vendors are not ahead of you here. Five frontier labs scored on logging, monitoring, gated actions, circuit breaking, third-party review and containment planning earned a best grade of C plus. OpenAI's own report on the Hugging Face incident says the evaluation ran without the production classifiers meant to block high-risk cyber activity, and that its current monitoring would have paged security more than a day earlier.

Then measure the clock that matters. Unit 42 documented an AI-assisted intrusion that went from a public web service to root credentials in under 10 hours with no zero day. EMA found 54.5 percent of organizations need hours to contain a misbehaving agent, and 34.2 percent check authorization at execution time. A revocation playbook written for a two week disclosure cycle is the wrong instrument for a one shift attack.

What the charter should contain

Seven lines, each with an owner and an artifact that can be produced on request.

What this costs, and why it lands on you

None of the seven needs new tooling to start. What they need is a decision and a name against each line, which is the cheapest work in this entire program and the work most likely to be deferred past the pilot.

The regulatory direction is not going to relieve you of it in this budget cycle. Spain's data protection authority, logging its first breach notification attributed to an AI agent, told companies to name AI-assisted and AI-executed attacks in their risk analyses and to add detection and containment that act at machine speed. California went further and licensed the auditor: AB 1405 creates an AI auditor registry that does not open registration until 2029, while a September executive order asks state agencies to accelerate independent oversight that the same state cannot yet staff.

Which means any control you need evidence for in the next two years, you are going to have to evidence yourself. Price that as headcount and tooling in the pilot, where it is a rounding error, rather than in the incident, where it is not.