It’s nearly impossible to imagine, because it would never happen. Just the idea should make every CISO uncomfortable.

So, the question must be asked: Why would we design agentic workflows this way? 

As we begin delegating human work to AI agents, enterprise security leaders cannot simply place a general-purpose AI model into every seat. They should preserve the same segregation of duties we have always implemented for humans, thinking about the specialization of each agent as well as the authority they grant it. 

Put Specialized Agents in Segregated Seats

The simplest vision for autonomous cybersecurity is also potentially the most dangerous: one agent that sees, understands, and does everything.

General-purpose models are increasingly capable, but they are designed to perform an enormous range of tasks. We cannot expect one to serve as a security specialist, even with a detailed prompt. 

A truly specialized security agent is designed differently — not to do everything, but to perform a defined role accurately, using deliberately managed permissions and context specific to that job.

Good agentic cybersecurity will look more like an organization: specialized agents performing different jobs, with different identities, permissions, and boundaries. They may work together, but no individual agent has authority over the entire process. 

Consider the threat-response example again. In reality, “detect, identify, respond, and recover” are different capabilities usually performed by different employees. 

Agents should operate in the same way. 

One specialized agent might continuously monitor the environment and identify anomalous activity. Another could investigate using threat history, identity, policy, and other context. A third could consume the output of the first two, and recommend the best response. Another could determine whether that action complies with enterprise policy. And, depending on the severity and type of action, a human or appropriately governed agent could authorize it. 

Only then would a specialized execution agent carry out the action.

The system preserves a record of the entire process: what was detected, what was recommended, which policy was applied, who or what authorized the action, and the result.

This is an agentic organization, built as a team of specialists and governed by checks and balances.

Guardrails and Permissions Address Different Challenges

Once those specialized seats exist, organizations need to govern them. That requires two kinds of controls: guardrails and permissions.

Guardrails define what an agent is allowed to do within its role. They are essential for general-purpose models, which hold enormous amounts of knowledge and capability; the organization has to constrain all the things it doesn’t want the model to do.

Permissions address what an agent can access and act upon, similar to rules we have around identity and access for people. Every agent should be treated similarly according to least privilege.

Specialization makes both guardrails and permissions easier. A purpose-built agent begins with a specific role and narrower context. It is deliberately constrained by design; it doesn’t need access to anything that isn’t relevant to its role. And while a generalized agent expected to perform dozens of jobs may require broad permissions, a specialized agent can have a much smaller access footprint. 

Consider financial services, where an agent tasked with identifying fraud may need access to sensitive transaction and device data. However, that doesn’t mean it should also have the authority to approve a response and execute it. Each agent should be given the context and access necessary for its role, and no more.

The permission model should include what systems the agent can access, what decisions it can make independently, how consequential those decisions can be, what it can approve, and at what point the potential blast radius requires escalation–either to a different agent or to a human.

The goal is to create safe delegation: enough authority for an agent to perform meaningful work, surrounded by controls that prevent any single agent from accumulating inappropriate power.

Human governance remains essential even as humans move out of individual operational loops. People should define the objectives, policies, authority boundaries, and escalation conditions under which agents operate. The goal is not human approval of every action, but human control over the system that determines which actions agents can take.

Agents Can Outperform in Accountability and Auditability

Not only does segregation of duties limit agent overreach, it also increases accountability. In this area, agentic systems could eventually outperform human workflows. 

We segregate duties to reduce fraud, create accountability, and prevent excessive authority from accumulating in any single actor. Those requirements do not disappear when the actor is a machine.

In addition, agents create the possibility of a much more accurate system of record. While approvals and actions can be recorded, humans are imperfect at reconstructing the “why” — every piece of information and reasoning that went into a decision.

With agents, interactions, decisions, actions, and results can all be captured as they occur, with immediate context. Organizations will be better able to reconstruct not only what happened, but also what information was available when decisions were made, which agents made them, what authority they had, and the results that followed. 

Rather than something organizations reconstruct after the fact, auditability will become a capability built directly into the agentic workflow.

Start Designing the Agentic Organization Now

CISOs don’t have to dive headfirst into a fully autonomous security operation. They can begin by asking the same questions they would ask when designing a human workflow.

What specialized job does this agent perform, and what context does it need? What identity, guardrails, and permissions should it have? And which actions require human oversight? Where does an independent check occur, and how can we build in auditability?

We're already beginning to see what this can look like. In mobile defense, for example, a live security change can follow a Request-Approve-Deploy process in which one role requests the change, another approves it, and an authorized administrator deploys it, with AI assisting the decision and a record preserved throughout the process. 

That begins with specialized agents, with the right permissions and context tied to their identity. Get the seat right and the access right, establish an automated pipeline for updating context, capture agent reasoning and tool calls, and the org chart will hold up under AI the same way it was meant to under humans.

Then, organizations of specialized agents can perform real work at machine speed while operating within clearly defined responsibilities, permissions and checks.

Segregation of duties has always been about not putting too much power in the hands of any single actor. That principle becomes more important, not less, when the actor is a machine.