AI agent permissions decide which person is entitled to which answer, and they have to be enforced in the system rather than requested in the prompt. That makes them an accountability decision rather than a configuration task. Writing in Forbes, Ethan Pham, Founder and Chief Executive Officer of XNOR Group, makes the case that most agentic AI programmes stall there, long before model quality becomes the issue.
Adapted from Ethan Pham’s column for the Forbes Business Council, published 29 September 2026. Read the original on Forbes.
Why agentic AI projects fail before the model is involved
Gartner predicted in June 2025 that more than 40% of agentic AI projects would be cancelled by the end of 2027, naming escalating costs, unclear business value, and inadequate risk controls. Model quality is absent from that list. Gartner’s 2026 Hype Cycle for Agentic AI put deployment at 17% of organisations, which means most of those failures happen well before production.
What consumes time is unglamorous. Configuring the model takes days; AI data readiness takes weeks. The work is inventorying document repositories, fixing naming conventions, and settling which version of a policy is authoritative. In XNOR’s own rollout, the slowest category was policy documents, where the same policy lived in several folders in more than one version, and the version people followed was not always the newest. One authoritative copy was published, and the rest were made unretrievable. None of that is model work, and none of it can start until AI agent permissions have an owner.
Who owns AI agent data governance: IT or the business?
The business owns it. Deciding who deserves to see what a judgment about accountability is, so it belongs to the people accountable for the consequences. IT implements that decision and cannot make it, and this handoff is where most programmes stall. AI agent permissions cannot be set by the people who implement them
The numbers around it are not really about AI at all. Netwrix surveyed 1,889 organisations in 2026 and found that 75% of sensitive data exposures start with a compromised identity or a misconfigured permission. Separately, ManageEngine found 93% of employees admit putting information into AI tools without company approval. Read together, they describe a permissions problem that AI inherits rather than creates.
How AI agent permissions work: same question, three different answers
The agent serves the whole team, but it answers by rank. XNOR built its first internal agent for finance leadership on that principle. A staff accountant asking about receivables gets the procedure. A team lead gets balances for their own scope. The CFO gets the full position. Entitlement resolves the identity directory before the model runs, never from what the user types into the prompt. Every answer cites the document it came from. No source, no answer.
Enforcement belongs at the API layer, not in the prompt. A document outside someone’s scope is not filtered out of the answer; it was never retrievable in the first place. An instruction to be careful is a policy. An architecture that never exposes the file is a control.
The hardest case is a shared channel. Answering fully briefs the entire room; refusing outright makes the tool useless to whoever authorised it. XNOR’s rule is that an answer in a shared channel is scoped to the least-privileged person present, even when the person asking is the CEO, and the agent says so and offers to continue privately. Nobody must remember the policy because it is the default.
What an enterprise AI governance framework looks like in production
XNOR runs three permission-aware agents inside Microsoft Teams: a CFO Agent, an HRM Agent and a Knowledge Bot. All three are fail-closed and fully audited, validated by 1,412 automated tests with 28 of 28 security evaluation cases and 12 of 12 data-isolation cases passing. See the full build.
Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026, against under 5% in 2025. Most of those will arrive inside software companies already licence, approved project or not. The advantage will not go to whoever deploys first. It goes to whoever has already answered the question of who is allowed to see what.
