Delinea's 2026 Identity Security Report, subtitled "The AI Enforcement Gap," finds that nearly every organization has a written policy for AI data access, but far fewer can enforce it at the moment an agent acts. The practical problem: AI agents keep their permissions after the work is done, and many organizations can't tell who authorized them in the first place.
What happened
Delinea published the report on September 29, 2026. According to the company's announcement, it is based on surveys of 2,254 IT and security leaders and 2,250 non-IT employees at organizations with 500 or more employees that use AI, across the UK, US, Germany, Australia, Singapore, UAE, France and India. Delinea sells privileged access management, so this is vendor research; the numbers are still useful.
The headline findings, as reported by Help Net Security and Delinea:
- Policy without enforcement: 99.7% of IT and security leaders said they have formal policies governing AI data access, but only 57% said those policies are documented and enforced well enough to know what data access is permitted. Help Net Security reports that 51% check AI access against policy in real time.
- Scope violations are common and caught late: 87% of IT leaders said an AI tool or agent accessed sensitive data beyond its intended scope in the past year. Fewer than one in five detect that as it happens, and Delinea says 55% take a full day or longer to detect it.
- Standing access: 42% of IT and security leaders said their organizations have no automatic removal of access when an agent's session ends.
- Weak traceability: only 36% can always trace sensitive AI access back to the person who authorized it.
- Employees route around approvals: 76% of employees said they have bypassed the required approval process for AI at some point, and 60% felt pressured to use AI with sensitive data without being sure it was permitted.
- Environment blind spots: across six environments the report looked at, 47% of organizations lack enforcement at the moment of action in at least two. CI/CD pipelines and Kubernetes were the weakest; cloud data stores were the strongest but still had gaps.
Delinea's recommendation is to authorize AI access at the moment of action rather than only at login, using continuous runtime authorization scoped to least privilege.
Why it matters
This isn't a new class of problem. It is the lifecycle and privileged access discipline identity teams already apply to people and service accounts, and the survey suggests it isn't reaching AI agents. An agent that keeps its permissions after its task ends is standing privilege. An access event nobody can tie to an approver is an orphaned entitlement.
It also connects to this week's Storm-3168 coverage, where attackers used compromised service principals with broad rights to wipe Azure resources. Persistent, over-scoped non-human identities are what attackers go after, whether they belong to a pipeline or an AI agent.
What to check in your environment
- Inventory AI agent identities. List the service accounts, app registrations, API keys and tokens used by AI tools and agents, and assign each one a named human owner.
- Check what happens when an agent's task ends. For each agent, confirm whether its credentials are short-lived or revoked automatically, or whether they persist until someone removes them. Prioritize the persistent ones.
- Test traceability. Pick a recent AI access to sensitive data and try to trace it to the person who approved it. If you can't, record that as an audit finding and fix the approval and logging path.
- Review CI/CD and Kubernetes first. These were the weakest environments in the survey. Look at which pipeline and cluster identities AI tooling uses and what those identities can reach.
- Bring agents into access reviews. Include AI agent identities in existing certification campaigns and PAM scope rather than creating a separate process that nobody runs.
- Measure detection time. Find out how long it would take you to notice an agent reading data outside its scope. If the answer is a day or more, you are in the 55% Delinea describes.