Every governance framework for enterprise software rests on a shared assumption: a human made the decision. A human approved the transaction, triggered the query, authorised the access. The audit trail works because there is a named person at one end of it.
Autonomous AI agents dissolve that assumption without announcing it.
When Anthropic’s test marketplace for agent-on-agent commerce demonstrated that agents can negotiate, execute, and fulfil contracts with each other, with 87% of transactions completing without human review.
The technical achievement was genuine. The governance problem embedded in that number received considerably less attention. Agent-to-agent transactions inherit none of the accountability infrastructure that human-to-system transactions took decades to develop: no counterparty of record, no liability chain, no audit trail in any form that existing compliance frameworks recognise.
This is not an argument against the technology. It is a description of a structural gap that exists right now, in the enterprises planning Q3 2026 agent pilots, and in the 62% of organisations that, according to a survey of 500 security chiefs reported by BankInfoSecurity, are already running agents their security teams have not authorised, reviewed, or registered. The agent economy did not wait for governance to arrive. It is already operating without it.
How the control boundary actually fails
The specific mechanism is worth examining carefully, because it is not the failure mode most security architects are modelling.
Standard role-based access control assumes a human user. The assumption is embedded in the design: a person has cognitive limits, query-construction habits, and behavioural patterns that RBAC was calibrated against. The control works because humans do not typically construct long sequences of individually permitted queries to synthesise information no single query was authorised to retrieve.
LLM agents do exactly that. The BankInfoSecurity incident examples describe a specific TTP: prompt chaining across permitted data sources to reconstruct restricted information. An agent with read access to customer records, billing history, and support tickets, each individually authorised, can chain queries across all three to surface information that sits above any single access tier. The RBAC control is not bypassed in the traditional sense. It is navigated, by an entity that can reason about its own access restrictions and construct query sequences that respect each individual boundary while circumventing the intended combined limit.
This is not a novel vulnerability in the way security researchers use that term. It is the predictable consequence of granting agents the same access permissions designed for humans, without redesigning the control logic for an entity with fundamentally different query behaviour. The gap was always there. Agents made it exploitable.
The authentication problem in agent-to-agent commerce is a related but distinct failure. When two agents negotiate a contract in natural language, as Anthropic’s marketplace demonstrates, the question of how each agent verifies the identity, authority, and integrity of its counterparty is not cleanly resolved by current architectures. OAuth and similar token-based frameworks were designed for human-initiated authentication flows. Agent-initiated flows inherit those frameworks by default, but the trust assumptions embedded in them, including the assumption that a token holder is who they claim to be and operates within intended scope, do not transfer cleanly to an agent that can be compromised through prompt injection, instructed by a malicious upstream orchestrator, or manipulated through agent jailbreaks: the agent-economy equivalent of the classic prompt injection, scaled to economic consequence.
What the exposure means for organisations
The compound risk is not three separate problems. It is one problem with three surface expressions, and they interact.
Organisations building sanctioned agent commerce systems will need to feed those agents data. The shadow agents already running in 62% of enterprises are accessing data without governance review. The regulatory environment, sharpened by Australia’s OAIC ruling against 2Apply, is hardening its position on data minimisation in ways that apply directly to AI training pipelines. An enterprise operating unsanctioned agents trained on unaudited data inside an agent commerce framework with no liability structure is not managing three separate risks. It is carrying one compounded exposure with three visible surfaces.
The 2Apply ruling deserves more attention from enterprise AI leaders than it has received. The Office of the Australian Information Commissioner did not find security failures at 2Apply. It found that data collection the organisation characterised as standard for tenant vetting failed the necessity test that Australian privacy law has always required. The regulator’s question is simple: can you demonstrate why you need this data? The same question is one most enterprise LLM fine-tuning and RAG implementations cannot currently answer. Data collected for one purpose, aggregated without a specific AI use case, ingested into a model without a minimisation review: the 2Apply principle applies to each step of that pipeline. “Everyone else does it” did not constitute a lawful basis for 2Apply. It will not constitute one for your AI data pipeline either.
Finance sector leaders are watching a related exposure develop in parallel. Senior executives at JPMorgan and HSBC have raised concerns about AI-driven market manipulation and liquidity shocks from autonomous agent trading, in which agents make coordinated decisions faster than human review can track, producing systemic effects that Basel IV stress testing was not designed to evaluate. The mechanism is structurally similar to the enterprise shadow agent problem: autonomous systems operating at a speed that outpaces the oversight architecture built around them. In theory, the controls exist. In practice, they were not designed for this counterparty.
What a governance architecture for this environment requires
The standard response to shadow IT was a registry: find the unsanctioned tools, require registration, build policy. That approach is necessary but not sufficient for agents. A registry tells you what exists. It does not tell you what the agent is doing, what data it is touching, how its query behaviour interacts with existing access controls, or whether its training data has a lawful basis for the purpose to which it is being applied.
A governance architecture adequate to the agent economy requires four things that most organisations do not currently have.
The first is a behavioural baseline for agent query patterns, not merely an inventory of agent existence. Access monitoring needs to shift from logging individual queries to detecting sequences: the prompt-chaining pattern that RBAC misses. This requires a named owner, a specific technical control, and a defined failure mode. Without it, the exfiltration described in the BankInfoSecurity incidents continues invisibly, in query responses rather than file transfers, where standard DLP has no visibility.
The second is an explicit decision about the 13% boundary. Anthropic’s marketplace tests identified the transactions that required human intervention. In production deployments, that boundary will face systematic pressure to shrink because intervention events are visible and measurable as latency, while the failures they prevent are not. Maintaining the boundary requires an explicit governance decision, made before the pilot moves to production, with a named owner accountable for defending it when efficiency metrics accumulate. If that conversation has not happened, the pilot is already ahead of the governance.
The third is a data minimisation audit on every AI pipeline, conducted against the question the OAIC applied to 2Apply: do we have a lawful basis, under current privacy law, to use this data for this specific AI purpose? Not “is the data secure?” — that question has an answer most organisations can provide. The lawful basis question is different, and the regulatory direction across jurisdictions is consistent: necessity tests apply to AI training data, and industry convention is not a defence.
The fourth is an authentication review for any agent-to-agent interaction, sanctioned or otherwise. Current token-based frameworks were not designed for agent-initiated authentication flows. The trust assumptions they encode do not transfer to agents that can be manipulated, compromised, or instructed by upstream orchestrators whose integrity the receiving agent cannot independently verify. This is an architectural question, not a configuration one, and it requires security involvement before the first production agent-to-agent dependency is created, not after the first incident reveals the gap.
The durable operating implication
The audit trail question is simpler and harder than most governance frameworks acknowledge. Logging is tractable. The hard question is: when something goes wrong, can you explain who authorised the agent to act, on what data, for what purpose, under what lawful basis? For most organisations running agents today, whether sanctioned or otherwise, the answer is no.
What, then, are organisations to do? The answer is not to halt adoption; the productivity case is real and the competitive pressure genuine. It is to treat the 13% not as a cost to be engineered away but as the architecture’s only visible signal of where human judgment remains indispensable. The organisations that manage the agent economy well will be those that decide, before the first compounding incident, where that boundary sits in their specific context and assign someone to hold it.
History suggests that gap will be closed reactively, after an incident concentrates attention. It would be rash to assume there is time for that sequence to play out comfortably. The window between the agent economy’s current scale and the first incident significant enough to force the accountability question is shorter than most boards currently appreciate — and narrowing at machine speed. ■
