Enterprise software vendors shipped AI agents into production workflows faster than the legal and compliance teams noticed. That’s not a hot take - it’s observable in how the conversations are structured: capability announcements come first, governance frameworks months later, sometimes never.
Salesforce, Microsoft, and ServiceNow all have agent products either live or in broad rollout as of late 2025 and into 2026. These agents don’t just answer questions. They send emails, update records, trigger downstream processes, and in some configurations, interact with external systems on behalf of users. The question of what they’re permitted to do - in a legally meaningful, auditable sense - is almost entirely unresolved at an industry level.
The Permission Problem Is Structural
Most agent systems currently rely on what their developers call “guardrails” - a word that has no agreed-upon technical definition, let alone a regulatory one. In practice, guardrails often mean a system prompt telling the model not to do certain things. Whether that constitutes meaningful access control in sectors like healthcare or financial services is, to put it charitably, unclear.
Data access is the more immediate issue. When an agent is granted access to a CRM, a shared drive, or an email account to complete a task, it typically operates with the permissions of the authorizing user - not a scoped, minimal set of permissions specific to the task. That’s a design choice that makes integration easier and security worse, and it’s currently the default.
Nobody Is Waiting
The EU AI Act includes provisions relevant to certain high-risk applications, but agentic AI operating inside enterprise software stacks doesn’t map cleanly onto its categories. US federal AI policy has moved slowly and inconsistently. Industry coalitions have produced principles documents, not enforcement mechanisms.
Meanwhile, companies are deploying because the competitive pressure is real. If your enterprise software vendor offers an agent that automates three hours of analyst work per day, opting out on governance grounds means your competitors get a three-hour head start.
The Audit Trail Problem
This is what doesn’t get enough attention: most agent systems produce logs, but those logs are not designed for liability assignment. When an agent-assisted decision results in a compliance failure - a miscommunication with a client, a data exposure, a contract sent to the wrong party - existing logs rarely tell you whether a human approved that action, or merely failed to stop it.
That distinction will matter enormously once litigation catches up with deployment. Right now, the gap between what these systems are doing and what organizations can actually account for is wider than anyone deploying them seems comfortable admitting publicly.