'This represents an important evolution in AI governance': Infosys lays out how your business can thrive with the new generation of autonomous AI agents

As businesses increasingly adopt autonomous AI agents that can access enterprise systems, make decisions and communicate with other agents, new challenges in governance and security arise. Umashankar Lakshmipathy, EVP and Head of Cloud, Infrastructure, and Security Services, EMEA at Infosys, explains that unlike traditional AI assistants, autonomous agents possess greater decision-making capabilities and system access, raising the stakes when errors or compromises occur.

These agents can impact business operations in significant ways, and their actions are difficult to trace, explain or rectify once initiated.

To manage these challenges, organizations must establish clear policies around each agent's business purpose, accountable owner, and access limitations. This includes defining boundaries for data, systems, and actions available to agents. Sensitive operations demand stronger safeguards, while a robust visibility system tracks the origin of outcomes, the agent executing them, and the tools employed.

This evolution in AI governance is crucial for harnessing the productivity benefits of agentic AI while minimizing operational, financial, and regulatory risks.

An emerging concern in enterprise environments is the growing prominence of "non-human identities," or AI agents that interpret information, make decisions, and initiate actions rather than merely executing predefined instructions. Visibility, ownership, and access management are essential as these agents communicate and collaborate, creating novel security risks.

When agents co-operate, they can automate complex processes across various business functions, but this interconnectedness also introduces potential points of failure. A compromised agent can propagate inaccurate information, influence other agents' decisions, or exploit privileged access to execute unauthorized actions.

Organizations must therefore strictly regulate agent collaboration by setting clear boundaries for business and security purposes. Each agent's identity, authority, and purpose should be independently evaluated, preventing unchecked trust or access privileges from transferring between agents. By striking a balance between granting autonomy and maintaining oversight, enterprises can leverage the benefits of multi-agent automation without sacrificing control and accountability.