Almost every organization now has rules for what AI tools and agents can access. Few can apply those rules at the moment an agent acts.
Delinea surveyed 2,254 IT and security leaders and 2,250 employees across eight countries. Their answers show AI governance that holds up on paper and breaks down in practice.
Executive summary
-
Nearly everyone has a policy. Half check it in real time.
99.7% of organizations have a formal AI data-access policy. Only 51% check AI access against it in real time. Fewer than 1 in 5 can detect a scope violation as it happens. -
Employees go around the rules, and executives do it most.
76% of employees have bypassed approval to use AI on work systems. 48% do it always or regularly. 60% have felt pressured to use AI on sensitive data when they weren't sure it was allowed. At the C-level, 81% bypass approval always or regularly, compared with 33% of intermediate staff. -
Agents get more access than they need, and keep it too long.
87% of IT leaders say an AI tool or agent reached sensitive data beyond its task in the past year, or suspect it did. Half let agents run on the launching user's full permissions. 42% have no automatic way to revoke agent access when a session ends. -
Controls check at the door, then stop watching.
47% lack enforcement at the moment of action in at least two of six major environments. CI/CD pipelines and Kubernetes have the least coverage. 55% took a full day or longer to detect their most recent AI overreach. -
Few can say who approved the access.
Only 36% can always trace sensitive AI access back to a named human authorizer.