Autonomy Creep: How AI Quietly Gains More Authority Than CIOs Intend
CIO, Wednesday, October 21st, 2026
AI agents gain authority through many small permission grants, so CIOs must govern what agents have become, not just what they were built for.
AI agents rarely get broad authority in one decision; instead, an agent starts with a narrow task, then gains connected systems, data access and fewer human approvals.
RSA's Jim Taylor says agents pile up permissions and "never give permissions back," which leads to toxic combinations of access.
1Password CTO Nancy Wang argues that each expansion of an agent's job should be treated as a real change, not just another feature.
The article urges CIOs to set up lifecycle reviews for agents the way they do for employees who join, change roles and leave.