A passenger aircraft is taxiing toward the runway, but air traffic control does not know who is flying it, where it is headed, or what it is carrying. More importantly, the aircraft can change course and divert to other airports without further authorization. No airport would allow such an aircraft to take off.
Many enterprises are deploying AI agents in much the same way.
Companies connect AI agents to customer databases, CRMs, financial systems, customer service platforms, and internal APIs, allowing them to read data, create tickets, modify orders, and even take actions on employees’ behalf. Meanwhile, enterprises may still not know which agents are running, who can use them, what system permissions they hold, or what data is being transmitted to external models.
The question is no longer simply whether the AI’s answer is accurate. Unlike traditional generative AI chatbots, AI agents do more than generate text; they interpret goals, invoke tools, and execute tasks. As a result, enterprises must govern not only model outputs, but also agent identities, permissions, and actions.
As AI Accelerates, Enterprise Governance Risks Falling Behind
As AI Accelerates, Enterprise Governance Risks Falling Behind
In its Hong Kong Cybersecurity Outlook 2026, the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) noted that Hong Kong recorded 15,877 cybersecurity incidents in 2025, representing a 27% year-on-year increase. The report also highlighted agentic AI, data leaks caused by weak enterprise AI governance, and supply chain risks as key cybersecurity issues for 2026.
This highlights a practical tension for enterprises:
- Business teams want to leverage AI to launch products, improve customer service efficiency, and automate workflows
- Security and compliance teams may not yet fully understand how agentic AI works, where the risks lie, and which controls are available
A blanket ban on AI might drive employees toward personal accounts, private devices, or unapproved platforms. Conversely, unrestricted access without monitoring or safeguards may expose customer data, financial information, internal documents, or source code beyond the enterprise’s control.
The solution is not a binary choice between a total ban and unrestricted access.
How Should Enterprises Secure and Govern AI Agents?
To establish effective AI agent security governance, enterprises must address two complementary control layers:
- Control Identity and Access: Determine which users and agents can access specific resources and perform specific actions
- Control AI Traffic and Content: Inspect which prompts, model responses, and API requests can pass through the enterprise AI environment
In the airport analogy:
- Identity controls answer: Who is authorized to take off, and where are they permitted to go?
- Gateway controls answer: What is the aircraft carrying? Is the flight path safe? Has it entered a no-fly zone?
Together, they form the two core control layers of enterprise AI security: Identity and Gateway.
Two Types of AI Risks Facing Enterprises Nowadays
Risk 1: Employee-Driven Shadow AI
When employees cannot find approved and user-friendly AI tools, they may turn to public generative AI platforms on their own. Most employees don’t do this with malicious intent, they simply want to summarize customer documents, analyze data, review code, or organize meeting notes.
However, when data is entered into an unvetted platform, the IT team has no visibility into what data left the enterprise, which user or account submitted it, how the platform handles the data, or how to investigate if an incident occurs.
This is Shadow AI—unapproved, unmonitored, and ungoverned AI usage within the organization.
Risk 2: Attacks on Customer-Facing AI Applications and Custom Agents
A second category of risk affects custom-built AI customer service tools, knowledge bases, workflow agents, or automated systems. While traditional chatbots mainly provide answers, AI agents can access internal data, call APIs, trigger workflows, or execute actions on behalf of users.
When attackers manipulate an agent via Prompt Injection, malicious documents, or tampered external content, the consequences can extend far beyond an inaccurate response. If an agent holds excessive permissions, it could read unauthorized data, invoke unapproved tools, or perform unsanctioned actions if successfully manipulated.
Building a Safe Runway: The Identity × Gateway Framework
An airport cannot rely solely on security checkpoints, nor can it rely solely on passports.
Even if a passenger passes identity verification, their luggage still needs screening. Even if a person’s luggage passes inspection, that does not authorize them to enter every restricted area or operate an aircraft. Enterprise AI security follows the same principle.
| Airport Operations | AI Security Control |
| Passport, staff ID, and boarding pass | Identity of user and AI agent |
| Authorized areas | System, API, and data access permissions |
| Baggage and cargo screening | Prompt, response, and sensitive data inspection |
| Air traffic control and route management | AI gateway, model routing, and policies |
| No-fly zones | Actions agents are not allowed to execute |
| Flight logs and black-box records | Logs, audit trail, and incident investigation |
| Emergency shutdown or grounding | Revoke credentials or deactivate the agent |
Runway 1: Controlling “Who Can Do What” with Identity Governance
Managing Internal User AI Access
Enterprises should first maintain a clear inventory of approved tools and integrate enterprise AI applications into existing identity management frameworks. Using Okta Identity Governance alongside SSO and MFA, enterprises can:
- Define which employees are permitted to use each AI tool
- Grant permissions based on department, job role, and device status
- Create access request and approval workflows
- Periodically review whether users still require continued access
- Revoke permissions when employees change roles or leave
- Maintain records of access requests, approvals, and changes
The core objective of identity governance is to ensure that users retain only the access they need for their roles, with least privilege enforced through lifecycle management, access requests, access certification, and auditing.
Treating AI Agents as First-Class Identities
AI An AI agent should not be treated as merely another software feature. If it can hold credentials, call APIs, read/write data, or act on behalf of others, it is a non-human identity and should therefore be managed as a separate identity. Every AI agent should have, at minimum:
- A unique identity
- An assigned human owner
- A clearly defined purpose
- Clearly scoped access to data and tools
- Short-lived credentials that can be revoked quickly
- Complete activity and authorization logs
- Offboarding and decommissioning processes
Okta for AI agents treats agents as first-class identities. It supports agent discovery and registration, human ownership, least-privilege access, short-lived credentials, lifecycle governance, auditing, and rapid revocation. Even if an agent is manipulated through prompt injection, identity and access controls can limit its permissions and reduce the potential blast radius.
Runway 2: Controlling What Data and Content Flow Through the AI Gateway
Identity controls determine who or what can access the system, but enterprises still need visibility into how data flows within the AI environment. For internally developed enterprise portals, AI applications, and API-based access to external models, Cloudflare AI Gateway provides a centralized control point between the enterprise and model providers. It can:
- Log model requests and usage
- Monitor tokens and cost
- Route and manage traffic across multiple model providers
- Use caching to reduce duplicate requests
- Apply and enforce consistent policies across AI traffic
- Inspect prompts and model responses for sensitive data
Cloudflare AI Gateway’s DLP scans prompts sent to models and responses returned by models, detecting sensitive information and applying enterprise-defined controls.
For customer-facing AI applications, enterprises can deploy Cloudflare AI Security for Apps at the application’s entry point to detect:
- Prompt Injection
- Personally Identifiable Information (PII)
- Unsafe or prohibited content
- Custom sensitive topics defined by the organization
- Abnormal token usage
Detection results can be integrated with WAF custom rules or rate limiting rules to log requests, apply restrictions, or block traffic.
Which Risks Do Identity and Gateway Controls Address?
| Risk | Identity Control | Gateway / Application Security Control |
| Unauthorized use of AI tools | SSO、MFA、IGA、Access Review | AI traffic visibility and policy enforcement |
| Sensitive data submitted to AI models | Restrict eligible users and devices | DLP scanning of prompts and responses |
| Prompt Injection | Restrict agent permissions and available tools | Prompt-injection detection and WAF enforcement |
| Excessive agent permissions | Least privilege, short-lived credentials | Limit accessible endpoints and permitted traffic |
| Uncontrolled agent behavior | Revoke permissions, deactivate agent | Request blocking and rate limiting |
| Untraceable operations | Identity and authorization audit trails | Prompt, response, and traffic logs |
| Uncontrolled model usage and spending | Restrict user and application permissions | Token analytics, caching and usage monitoring |
Neither control layer is sufficient on its own. A gateway may show what traffic is flowing through the environment, but not who or what initiated it or whether they were authorized. Identity controls may show who accessed the system, but not what data the prompt contained or what information the model returned.
Conclusion: Let Enterprise AI Take Off Safely
Enterprises cannot keep AI grounded simply because it introduces risk; nor can they allow agents to operate with self-defined identities, permissions, and data flows in the name of faster innovation.
Enterprises can start by inventorying their AI tools, agents, model APIs, service accounts, and credentials to identify which users, agents, and systems are using AI. Next, define which data and systems each user or agent can access and which actions they can perform, require human approval, enable rapid access revocation, and maintain audit logs for high-risk actions. Finally, choose a pilot use case with well-defined users, data sources, and permitted actions, such as internal knowledge search, customer support summarization, or IT ticket classification. Establishing controls for identity, permissions, traffic inspection, DLP, logging, and incident response before gradually expanding to other AI applications.
Sustainable AI governance means that every user and agent has an identifiable identity, every permission is clearly scoped, prompts and model responses are inspected according to policy, and every critical API action can be traced. When an agent exhibits anomalous behavior, the enterprise must be able to quickly restrict or revoke its access, or deactivate it entirely.
The goal is not to ground enterprise AI, but to ensure that every flight has an identified operator, an authorized route, inspected cargo, and a complete record.
With the Identity × Gateway framework, enterprises can transform AI agents from an uncontrollable experiment into a secure and scalable enterprise capability. Please contact the advisory team at Master Concept for more information!
FAQ
What are the main cybersecurity risks of AI agents?
The main risks of AI agents include Prompt Injection, sensitive data leakage, excessive permissions, credential abuse, uncontrolled tool invocation, and a lack of comprehensive audit logs. Because agents can take real-world actions on behalf of users, their risk profile is generally higher than that of text-only chatbots.
Should enterprises completely block public AI tools?
A blanket ban is rarely effective. Bans often drive employees to personal devices or ungoverned platforms. A more sustainable approach is to provide approved AI tools and combine them with identity management, usage policies, employee training, traffic visibility, and DLP.
How can enterprises prevent Prompt Injection?
Enterprises should not rely solely on system prompts. A comprehensive strategy includes prompt-injection detection, input validation and content policies, identity authentication, least privilege, authorization for tool calls, human approval for high-risk actions, and complete audit trails.
Why should AI agents be treated as non-human identities?
Because AI agents can hold credentials, call APIs, access data, and execute actions on behalf of users. Managing an agent as a separate identity allows enterprises to assign human ownership, limit permissions, manage its lifecycle, and trace every operation.
How does AI Security differ from traditional Application Security?
Traditional application security focuses on vulnerabilities, APIs, infrastructure, and unauthorized access. AI security extends these controls to model interactions, data flows, prompts, responses, and agent actions. Because AI applications can interpret natural language, access enterprise data, invoke tools, and perform tasks, organizations must secure both the underlying application and the AI-specific interaction layer.
Does implementing Cloudflare and Okta require refactoring existing AI applications?
In many cases, integration may require only limited changes to API routing, reverse-proxy configuration, authentication, and authorization. However, the effort required depends on the application’s existing architecture, model providers, streaming design, API authentication, and tool invocation methods. Organizations should not assume that integration will require no application changes.
