The gap worth checking
A policy can say exactly what an agent may do while the connection gives it considerably more freedom. Delinea’s September 29 survey announcement puts that gap at the center of its argument about AI governance.
The provider reports survey findings from IT and security leaders and other employees at AI-using organizations with at least 500 staff. We read the announcement, not the full survey report. Its population and commercial context matter: it is not a census of all businesses, an incident-forensics dataset or proof that any particular Silver Owl system is affected.
Source: 2026 Identity Security Report: The AI Enforcement Gap · 2026-09-29 · Primary source context · attributed account
Source: Agents API gains computer use · 2026-09-29 · Primary source context · attributed account
Permission needs an address
Silver Owl’s position is that a useful AI access rule names the resource, action and authorizer. Saying an agent may help with customer support is a business purpose. It does not settle whether the agent may view every customer record, change a refund amount or export a conversation.
Imagine a hypothetical support assistant preparing a response from an approved knowledge base. If the integration also exposes administrative actions, the organization is asking the assistant’s interpretation of its assignment to carry too much of the boundary. Technical permissions and human authorization should make the intended distinction observable.
This is not an argument that every action needs a new approval dialog. Routine, already authorized work can remain routine. The important question is whether the system can distinguish that work from an escalation, and whether its record identifies the person or rule that authorized the action.
A browser does not decide the business boundary
OpenAI’s September 29 API changelog describes hosted-browser computer use for its Agents API, with website approvals and sign-in handled by the application. That is a concrete reminder of where integration responsibility lives. A hosted execution environment does not decide which customer account or business action your application should permit.
Our suggested review begins with one ordinary workflow and follows its access. Which identity reaches the website? Which permissions accompany that identity? What evidence would reveal an attempted action outside scope? Ask those questions before buying another dashboard to summarize permissions nobody has checked.
Recovery matters too. A team needs to understand how an interrupted action is reconciled, how a session is ended and how residual access is identified. These are review questions, not a claim that any specific product fails them.
The survey headline may attract attention. The useful result is a checked answer about one real connection. Written policy becomes credible when the access path and the activity record agree with it. Until that check is done, the policy describes an intention.