AI agents keep access to company data after their work is done

The Delinea 2026 Identity Security Report, “The AI Enforcement Gap,” reports that while nearly all organizations have formal policies governing AI tool access, many lack real-time enforcement, session termination, and traceability—resulting in AI agents retaining permissions after tasks, accessing sensitive data beyond intended scope, and delayed detection and remediation. The survey highlights widespread employee uncertainty about allowed use, frequent policy bypassing, and limited ability for security teams to trace or immediately revoke agent actions, creating systemic risk even without a single reported incident.