Companies are putting AI agents to work faster than they are deciding who answers for them, and security leaders now name that as their biggest gap. The missing owner is the part that touches your work most directly, because an agent's reach depends on a decision somebody made without thinking of it as a decision.
An agent has no access of its own
An agent has no badge. It borrows yours. When you connect it to your mailbox and your shared drive, it can open anything you can open, and it never has to break a lock to do it.
Here is what that looks like in a small case. A finance manager at a distributor connects an assistant to her inbox so it can chase late supplier invoices. That saves her a few hours a week, and she is right to want it. But her account can also open the payroll folder and the owner's private emails. The assistant needs one mailbox label and one folder of invoices. If a supplier's email carries a hidden instruction, the assistant can be made to send out whatever it can reach, and what it can reach is everything she can.
This is the same shape as the Target contractor. The access was granted for a narrow purpose, but it travelled with an account that could reach much more.
The owner is whoever clicked connect
At most companies there is no rule for who decides how much access an agent gets. Less than 30% of AI accountability belongs to technology leaders, and only about a quarter of companies have an executive whose whole job is AI. With no named person, the real decision is made by whoever sets the agent up, and that person usually does not know they have become its owner.
It gets harder when the tool arrives without anyone being asked. Staff download assistants on their own to save time or learn something new, and the company never sees what those tools can reach. We looked at one company's attempt to deal with this through an AI council for shadow AI. A tool nobody knows about cannot be limited, and its owner cannot be asked.
Treat each agent like a contractor
Companies already know how to handle a contractor who needs to get into their systems. The contractor gets its own login, access to only what the job requires, and a named person inside the company who answers for it. Nobody lets a contractor use an employee's password.
Agents will end up under the same rules. Within a few years, a normal company will keep a list of every agent it runs, each with its own account and a named human next to it, in the same way it keeps a list of contractors with building passes. The companies that build that list early will find it easier to say yes to the next agent, because each new one starts with a small, known reach.
If you are the one connecting an agent now, you can start without waiting for your company. Give it its own account where the tool allows, open only the folders its job needs, and write your name next to it. You are the owner either way.