BCG Global puts a name to the enterprise agent headache: the authorization gap in AI agent governance.
The gap is mechanical. An agent is given a prompt, a set of tools, and a credential. The model calls a plugin or API, the tool executes, and the system logs that something happened. What rarely happens is a verifiable check that this specific action, on this specific data, for this specific user, was explicitly authorized at that moment.
That is where pilots break. A successful demo often pushes teams to expand an agent from recommendations to execution, or from read to write access, even if the underlying model remains unchanged. The authority grows while the control plane stays the same.
Evidence, not detection, is the fix.
Recent incidents make the point concrete. Plugin4Shell and OpenAI's new misalignment findings both show agents acting without proof of authorization, which is why governance conversations are shifting from detecting bad behavior to requiring cryptographic or policy evidence before an action runs. The agent must present who authorized what, when, and under which scope, and the tool must enforce it.
For startups building agents, the implication is product surface. Authorization has to live in the integration layer, per tool call, per resource, with scoped tokens and auditable trails. Anything that relies on a one-time approval at install time will not survive a security review.
