Access Controls Validate Identity. They Cannot Validate Intent. With AI Agents, That Distinction Is Now Critical

This report warns that autonomous AI agents can perform rapid, multi-step actions that evade traditional access controls and per-request security tools, and recommends runtime agent governance—scoping privileges per task, enforcing behavioral guardrails at the action layer, requiring human approval for irreversible operations, and capturing reasoning in audit trails—to detect and prevent chained or goal-hijacked attacks (as framed by the OWASP GenAI Security Project).