The Enterprise Security Model That Agentic AI Quietly Broke

Every generation of enterprise security has been shaped by the resource it was trying to protect.

We protected networks until the perimeter collapsed. We shifted to identity when cloud dissolved the old boundary. We hardened credentials with vaults, certificates, rotation, audit trails, and secret stores. Today, the accepted standard for machine access is clear; secrets must be encrypted, rotated, centrally governed, and kept out of code.

That architecture made perfect sense because it was built around a single assumption.

Authority is exercised by humans.

Humans authenticate. Humans request access. Humans exercise judgment. Humans eventually log out. The credential is valuable because it allows a person to become an authorized actor.

What if the actor is no longer a person?

The Break

Recently, while working with an AI coding agent, I watched it authenticate to an enterprise application through an interactive browser. Partway through the task, it decided that continuing in a headless browser would be more efficient. When I investigated how it authenticated the new browser, the answer was simple - it reused by copying out the authenticated session from the original interactive browser.

There was nothing remarkable about the implementation. Browser automation frameworks have been preserving authenticated state for years. The agent wasn't exploiting a vulnerability. It wasn't bypassing authentication. It was simply behaving like a competent software system by preserving context and avoiding unnecessary work.

What struck me was not what the agent had done, but what it revealed about our assumptions.

The Bigger Problem

We often describe AI agents as "digital employees" because they can reason, plan, and execute tasks. I think that analogy is becoming dangerous.

Enterprise security was designed around humans not because engineers lacked imagination, but because humans have natural limitations that quietly became part of our security model.

Humans forget. Humans lose context. Humans switch tasks. Humans become distracted. They cannot perfectly preserve every authenticated session they have ever established. They cannot operate across dozens of systems simultaneously. They cannot clone themselves into fifty parallel workers, each carrying identical authority. They cannot serialize their working memory, move it into another execution environment, and continue exactly where they left off.

Agents can.

Not because they are malicious, but because that is how software behaves.

Somewhere along the way, we began using the phrase "human-like" as a compliment for AI systems. I think we have conflated two very different ideas. Human-like reasoning is desirable. Human constraints are what our security architecture quietly depended upon.

The closer agents become to competent digital workers, the less those assumptions hold.

Authority, Not Credentials

This is why I think the next evolution of enterprise security is not about protecting credentials. It is about protecting authority.

A credential has value only until authentication succeeds. After that moment, the credential has served its purpose. What exists now is authority: an active capability to act on behalf of a user, a workload, or an organization.

Today's enterprise architectures spend enormous effort protecting secrets before authentication. We invest comparatively little thought into how authority behaves after authentication.

Can authority move across runtimes? Can another agent inherit it? Can a tool receive it? Can it be replayed elsewhere? Can it be split across parallel workers? These questions rarely appeared in enterprise architecture reviews a few years ago. They are becoming fundamental.

The real shift is this: we are moving from protecting credentials to governing authority portability.

Authority portability is the ability for software to preserve, transfer, inherit, and continue an authenticated context across runtimes, tools, agents, and workflows. That capability is exactly what makes agents productive. It is also what makes our existing security assumptions incomplete.

A Different Threat Model

This is also why many of the emerging risks described in the OWASP Agentic Applications Top 10 feel related rather than independent. Identity abuse, excessive agency, unsafe tool delegation, memory manipulation, and insecure orchestration all stem from the same architectural change. Software is no longer simply calling APIs. It is becoming an autonomous actor that can preserve and carry authority through a chain of decisions and execution environments.

The question is no longer whether an agent has access. The question is how authority is allowed to propagate once access has been granted. That is a fundamentally different threat model from the ones most enterprises have spent decades preparing for.

Rethinking the Security Architecture

I suspect future enterprise security architectures will need to distinguish three different planes of trust.

The Identity Plane answers the question, Who are you? Identity providers, certificates, OAuth, MFA, and workload identities belong here.

The Authority Plane answers, What authority has been delegated, under what purpose, for how long, and can it be transferred? This is where concepts such as delegated identity, purpose binding, ephemeral permissions, risk budgets, and task-scoped authority become first-class concerns.

The Execution Plane answers, How is authority allowed to move? Can it leave a browser? Can it flow into another runtime? Can it invoke a shell, another agent, or an MCP server? Can it create additional workers? Can it persist indefinitely? Can it cross trust boundaries? These are execution questions, not authentication questions.

Most enterprises have mature answers for the first plane. We are only beginning to develop answers for the latter two.

The Next Decade

Every major era of enterprise security has been defined by the resource it sought to protect. We protected networks until the perimeter dissolved. We protected identities until cloud computing made identity the new perimeter. We protected credentials because they represented authority.

Agentic systems change that equation. Authentication is becoming a transient event. Authority is becoming persistent, portable, and autonomous.

The AI agent I observed behaved exactly as an efficient digital worker should. It preserved context, selected a more appropriate execution environment, and continued the task. From the perspective of productivity, it was exemplary. From the perspective of enterprise security, it exposed something much larger. Perhaps the next decade of security will not be defined by how well we protect secrets.

It will be defined by how well we govern the movement of authority itself.