Your company already adopted AI and nobody is governing access

Antoine Berton (Elba Security) explains the AI attack surface, highlighting five exposure points — standing OAuth grants, copilots inheriting human permissions, agent credentials in configs, missing off-boarding, and unclear authority when agents act — and argues that identity governance controls (inventory, ownership, approval, least privilege, audit, revocation) can be applied to secure AI agents, with two practical steps teams can implement immediately.