For most of the past two years, AI primarily functioned as an adviser. It answered questions, generated content, analysed information, and offered recommendations while humans remained in the driving seat in terms of making decisions.
Agentic AI is changing that. Organisations across Asia-Pacific are increasingly deploying AI systems that can retrieve information, interact with applications, trigger workflows, and complete tasks on their own.
IDC, for example, finds that 75% of organisations in the region have deployed agentic AI in some form. However, faced with mounting pressure to improve productivity, accelerate innovation, and demonstrate returns on investment, many are adopting these systems faster than the controls designed to govern them.
Organisations across Asia-Pacific are already recognising the implications. An IDC InfoBrief commissioned by UiPath, “Agentic automation: Unlocking seamless orchestration for the modern enterprise,” found that 51% cite data privacy breaches as a concern, 48% worry about security risks arising from autonomous actions, and 47% are concerned about unintended consequences from increasingly complex interactions.
Notably, these concerns are less about output quality and more about access and accountability. Yet much of the conversation remains largely centred on model hallucinations and bias. Important though they are, there needs to be more focus on the waning human safety layer.
When AI can act, accuracy is no longer the only risk
Identifying vulnerabilities rests on distinguishing what autonomous systems can access and what authority they actually possess. A chatbot guiding users on how to book a flight is relatively low risk. An AI agent that books the flight is a different category altogether because it evaluates options, accesses personal information, interacts with external services, and commits resources independently.
At that point, the system is no longer simply a tool, but an active participant. If permissions are overly broad or boundaries are poorly defined, these systems are likely to discover and use those pathways, not necessarily maliciously, but because they are optimising for the outcome they were instructed to achieve.
In short, without external constraints, agent capability naturally expands to fill available access. This brings us to why organisations must be equipped to understand who the agent represents, what task it was authorised to perform, what data it should be able to access at that moment, and which actions are genuinely necessary to complete the objective.
Today’s AI models are remarkably effective at prediction and generation, but they remain poor judges of their own certainty. They can produce confident, plausible outputs without reliably recognising when they are wrong. In a conversational interface, that may be an inconvenience. In an autonomous system with broad permissions, it can have real-world consequences.
Managing agent capability with contextual constraints
An agent that can move money, access sensitive information, approve transactions, modify infrastructure, or trigger business processes only needs to be mistaken to create damage. This challenge is even more pronounced in multi-agent environments, which is why the conversation around “trustworthy AI” misses the point.
Agentic systems are powerful and increasingly valuable, but they remain too unpredictable to operate without meaningful constraints when access and execution are involved. The objective should not be to make agents perfectly trustworthy, but to ensure that when they make mistakes, the consequences are contained.
If organisations cannot answer who performed an action, on whose behalf it occurred, and why it was permitted, they have already lost visibility into the most important layer of control. Context, therefore, allows harmful behaviour to be distinguished from ordinary activity by ensuring that every action is traceable to an identity that is governed by permissions.
The challenge is that most enterprises are still operating with access models designed for a pre-agent world. Permissions are broad, while access is frequently persistent, and roles remain static. This is because many organisations in Asia-Pacific and globally struggle to define exactly what an agent needs at any given moment, and so compensate by granting more access than necessary.
What needs to be done now
As deployment scales, awareness of the risks from agentic AI is gradually growing. IDC predicts that, by 2030, 15% of the 1,000 largest organisations in Asia-Pacific, excluding Japan, will have faced lawsuits, substantial financial penalties, and CIO dismissals linked to failures in governing AI agents.
Meanwhile, Gartner’s research report “2026 Predicts: Identity and Access Management” identifies identity and access management for AI agents as a foundational requirement for safe deployment, warning that the inability to establish and manage agent identities could become a major vulnerability.
The urgent question now is whether organisations have established sufficient controls over what those systems can access and execute. The order of business must be to constrain the identity under which the agent operates, limit the permissions it receives, and restrict the duration for which access is granted.
Without effective governance, agent behaviour can appear entirely reasonable right up until the moment it becomes a breach. And when that happens, the question will not be how smart the AI was; it will be who allowed it to do that.
