How authority creeps instead of arriving
No CIO signs off on an agent getting more power than intended, at least not in one step. An agent typically starts with a narrow, well-scoped task, then over weeks or months picks up access to additional connected systems, broader permissions, and fewer required human approval steps. Each individual change looks defensible in isolation: a new integration that saves time, an approval step removed because the agent has been accurate so far, a permission added to unblock one specific workflow. The cumulative result is an agent operating with far more authority than anyone deliberately approved.
This matters because most governance frameworks are built to review decisions, not drift. A quarterly access review catches a single large grant of permissions. It is much worse at catching twelve small grants made across different teams over the same period, none of which individually triggered a formal review. RSA's Jim Taylor, president and chief product and strategy officer, describes this pattern plainly: agents accumulate access over time and, in his words, they never give permissions back on their own.
Why model guardrails alone do not solve this
Taylor's broader argument is that model-level guardrails, the instructions and constraints built into how an AI system is prompted and tuned, are necessary but not sufficient on their own. A model can be told what to avoid, yet that instruction lives inside the same system whose behavior is being constrained, which is a fragile place to put the only safeguard. Taylor recommends layered controls that sit outside the model entirely: continuous certification of agent identities, and attribution of every action an agent takes back to a specific, responsible identity rather than a generic service account.
1Password's Nancy Wang frames the same problem from the access management side. Every time an agent's scope expands, she argues, it crosses what amounts to a new authorization boundary, whether or not anyone labels it that way internally. Her recommended fix is what she calls verified loops: a human defines the task, the tools available, what counts as evidence of success, and which actions are explicitly prohibited, while a separate verifier checks the agent's actual output against that definition rather than trusting the agent's own report of what it did.
Replacing standing privileges with runtime authorization
Wang's concrete recommendation is runtime, task-based authorization built on short-lived credentials rather than standing privileges that exist by default and sit unused most of the time. A standing privilege is a liability the moment it is granted, because it remains exploitable whether or not the agent is actively using it. A credential that is issued for a specific task and expires when that task ends shrinks the window during which excess authority can be misused, whether through a bug, a compromised agent, or simple scope creep nobody noticed.
This is a meaningfully different architecture from how most enterprises provision access for human employees, where standing roles tied to a job title have long been the norm. Agents do not have job titles in any meaningful sense, and applying human-style role based access control to them tends to either over-provision access for convenience or under-provision it in ways that break workflows, both of which push teams back toward granting broad, persistent permissions out of frustration. Task-scoped, expiring credentials avoid that trap by matching the grant to the actual unit of work.
The oversight trap NatWest is trying to avoid
NatWest Group offers the clearest example of what deliberate, monitored authority reduction looks like in practice. Paul Dongha, head of responsible AI and AI strategy, described agents handling complaint intake, where automation covers information retrieval but a human still makes the final decision on the complaint itself. He named the actual risk directly: the temptation is to give over to the AI simply because it has proven reliable, which is exactly how oversight erodes without anyone deciding it should.
NatWest's approach is to treat any reduction in human oversight as its own deliberate decision, made with stakeholders and risk managers in the room and followed by continued monitoring rather than a one-time sign-off. The bank is also building what Dongha calls an AI control tower, aimed at giving leadership visibility into multi-agent networks as a system rather than relying on monitoring each agent individually. That system-level view matters because authority creep often happens at the seams between agents, not inside any single agent's own logic.
The failure mode CIOs should watch for specifically
The most dangerous version of this problem is a human reviewer who quietly becomes a rubber stamp rather than a single reckless deployment. When an agent performs well for long enough, the humans nominally approving its actions tend to approve faster, scrutinize less, and eventually drop out of the workflow entirely without anyone formally deciding that oversight was no longer needed. That quiet exit is harder to detect than any single bad decision, because nothing visibly breaks until the agent encounters a situation its track record never covered.
Catching this requires treating oversight itself as something to monitor, not just the agent's output. That means watching approval times trend toward zero, watching the rate at which humans override or question an agent's recommendations trend toward zero as well, and treating both trends as warning signs rather than evidence of success. A governance program that only measures the agent is missing half the system; the humans supervising it are the other half, and they degrade just as predictably if nobody is watching for it.
What to put in place before the next deployment
Before deploying any new agent, define its owner, its specific capabilities, the maximum authority it can ever hold, the explicit triggers that would require a scope change, and the categories of action that always require a human decision regardless of how reliable the agent has proven. Assign that owner by name, not by team, and build a transfer process for when that person changes roles, because an orphaned agent with no accountable human is exactly where authority creep accelerates unnoticed.
Test multi-agent systems as whole systems rather than validating each agent individually, since creep often happens in the handoffs between agents rather than inside any one agent's defined scope. Maintain traceability across ephemeral agent teams that spin up for a task and disband afterward, because a system with no memory of what a temporary agent did is a system that cannot be audited later. None of this requires pausing AI deployment, but it does require treating every scope expansion as a decision someone made on purpose, not a drift nobody noticed until it mattered.
