AI risk filed in the wrong drawer: agents hold staff entitlements and nobody signs for them

Arif's stated worry is the gap between the speed of AI adoption and the maturity of AI governance ^[5]. That framing is common enough to be furniture. What makes his list of missing rules worth reading is its last item: alongside approved use cases, sensitive data handling, vendor assurance, retention and model outputs, he puts human accountability ^[6]. Later he compresses agentic risk into three questions, and the third is who is accountable for the outcome ^[10]. The published portion of the interview never names a role that answers it ^[15].

There is a mechanism behind that absence. Entitlements for people arrive through a process with a paper trail: someone is hired, a manager approves the access, the access gets reviewed, and when they leave it is withdrawn. An agent's entitlements arrive through an integration, and an integration is a build decision. Nothing on that path produces a manager, a review date or a leaver event, and the identity it creates can operate across multiple systems and call external tools by itself ^[9].

The controls Arif prescribes are not exotic: AI governance, identity, permissions, logging, monitoring and human oversight ^[11]. Most of that is old practice. What does not transfer is the assumption underneath it, that each privileged identity maps to a person on a payroll who can be asked what happened. Access review tooling exists to make a manager attest to a subordinate's permissions. There is no equivalent when the holder is a service principal spun up during a pilot, and no attestation queue it lands in.

One caveat on the sourcing. This is a single practitioner at one insurance group ^[1], with no incident counts, no survey and no figures. The claim that organisations treating AI security as tomorrow's problem are already behind, with the cost of catching up rising from here, is The Cyber Express's framing of his position rather than anything he measured ^[13]. The part of his argument that does carry weight on its own is the trust model claim: security is no longer only about systems, networks and users, and now has to account for what AI can access, what data it can process, what decisions it may influence and what actions it may trigger ^[4]. The last of those four is the one that matters operationally, because triggering an action is the only item on the list that changes something outside the model before a human reads it.