Business applications, like enterprise resource planning (ERP) systems, house an organization’s financial data, and run critical processes like payroll and procurement. AI adoption has taken off in software development and other workflows, but finance teams and business application owners have had good reason to move more carefully.
Yet Delinea’s 2026 Application Access Governance Report shows AI agents are no longer limited to analyzing data. They are already taking action inside the applications that run the business, like ERP, CRM, HCM, procurement and other systems that move money, pay people and manage customers.
In this blog, I’ll outline the AI-related findings from the 2026 Application Access Governance report and share recommendations for governing and securing AI agents in business applications. To learn more about findings from the report related to foundational controls, read: The confidence gap in application access governance.
If you use tools like Claude, Copilot, ChatGPT or Gemini to boost efficiency, you may not be surprised to learn that, of the 1,000 surveyed organizations, 88% use AI tools or AI agents within their critical business applications.
35% of organizations have deployed AI agents inside critical business applications that can perform actions
In the context of an ERP system, that means AI agents can execute a transaction, change a record or alter permissions. Only 45% of AI-using organizations run every agent under its own dedicated identity. The rest have at least some agents acting on shared or borrowed human credentials, often through delegated or on-behalf-of (OBO) access.
Despite the sensitivity of financial data, organizations believe they have more oversight of AI agents than they do. Most say they have at least partial visibility into agent deployment, access and ownership. Fewer than half track any of it fully and centrally. And when visibility gets tested, it often fails. A full 32% of AI-using organizations report an agent took actions that could not be traced or explained during a review.
AI agents act without human review and controls are inconsistent
Among the 879 respondents who use AI tools or AI agents in critical business applications, roughly one in six reports that tools and agents can perform consequential actions autonomously, without human review.
These actions include accessing sensitive or regulated data (17%), creating or changing business data (16%), executing or approving transactions (15%), changing user permissions (14%), and changing application configurations (14%).
Fewer than half of AI-using organizations consistently apply each common governance control to all AI tools and AI agents. The share ranges from 48% that log and monitor activity to 40% that remove an AI agent’s access when its owner leaves or changes roles. Only 43% consistently include AI tools and AI agents in segregation of duties (SoD) analysis, and 44% include them in user access reviews (UARs).
Put simply, agents that can move money and change permissions are not being governed like the identities they are. The controls mandatory for a new hire, including least privilege, SoD analysis, access reviews, and removal at departure, are not yet being applied to AI
agents with the same rigor.
Organizations using AI are reporting issues
The risk is not theoretical. 84% of organizations using AI tools or AI agents in critical business applications report at least one AI-related issue in the past 12 months. Only 16% say nothing has occurred.
The most frequently reported issues are actions that reviewers could not trace or explain during a review at 32%, incorrect financial transactions attributed to AI activity at 30%, SoD conflicts created by AI at 28%, agents that continued operating after the person who deployed them left at 28%, and unintended or unauthorized actions at 28%. Another 26% report that an AI tool or AI agent accessed data it should not have had access to.
Several of these issues line up with the control gaps above. Agents kept running after their owner left because nothing removed their access. Conflicts appeared because agents sit outside SoD analysis. Actions went unexplained because activity is not consistently logged and monitored.
Organizations are struggling to keep governance aligned with AI adoption. Among AI-using organizations, 44% say AI deployment is outpacing governance and security controls, and only 11% say the two are keeping pace.
Recommendations for AI governance in business applications
The pattern across these findings is consistent. AI agents are identities with transaction-level access, but most organizations still manage them like features of an application. The fix is not a new governance program. It extends the one you already have, and you must complete the AI security fundamentals before you look ahead.
-
Know every agent in your business applications and assign a named owner. Within business applications, agents act through an identity within the application’s security model, thereby making the application your system of record. Identify which identities your AI tools and agents act through, what each can access and the person accountable for its actions, and keep that view current as new agents are added.
-
Know how each agent is deployed and govern the delegation. Every platform handles agent identity differently. Some agents run under dedicated identities; others act on behalf of a user or run as background jobs under delegated credentials. Any of these can be governed. What matters is that agent activity is attributable as agent activity, and that you know whose permissions it is exercising.
-
Enforce least privilege for every identity, human or not. The principle does not change because the account is an agent or a workload. Understand the risk profile and sensitive access you are granting to each identity before deployment, grant just enough access for the task at hand, and put the right approvals in place for new access.
-
Extend your existing controls to every account, including AI. Include every account in SoD and sensitive access risk analysis, agents alongside the humans they act for. Wrap access reviews around them. Monitor critical data and configuration changes so you can see who changed what, whether the who was a person or an agent. Bind agent access to its owner’s lifecycle, so a role change or departure ends the agent’s access too.
-
Remember that agents operate at machine speed. An agent does not make mistakes one at a time. It can perform thousands of actions in the time it takes a human to perform one, so a mis-scoped agent is a misconfiguration at scale. That is why the controls above matter before deployment, and why monitoring and change tracking matter after it. The sooner a bad grant or an unauthorized change is caught, the smaller the blast radius.
These findings focus on agents operating within business applications, where transactions occur and financial materiality lives. Agents are being deployed across the enterprise, and governance has to meet them where they act. For agents reaching into systems from outside, that means runtime authorization: deciding and enforcing privileged actions as they happen, human or agent, from infrastructure and endpoints to the platforms where agents run. For agents built into business applications, this means governing them within the application’s security model with the same rigor we apply to humans. Delinea is investing in both, because the consequences of getting it wrong are measured in dollars, data and audit findings.
Read the full findings in our 2026 Application Access Governance Report.
WHITEPAPER
The AI Governance Gap
