Science & Tech · Cybersecurity · 4 hrs ago
Why enterprise security teams should learn from fraud teams
AI agents can act on behalf of people, using credentials and accessing systems to complete tasks.
Retailers, banks and payment processors already allow agents to make transactions for consumers.
That raises a security challenge: an agent can be properly authenticated and still take an action the user did not intend.
Fraud teams address a similar problem by examining behavior and context, not just whether a customer logged in successfully.
The same approach could help enterprise security teams assess what agents do after they gain access.
The commentary recommends limiting an agent’s permissions to specific tasks, tools and time periods, and requiring clear approval for sensitive actions.
It also says organizations should track how authority passes between people, agents and systems so they can review who initiated an action and how delegated access was used.
Retailers, banks and payment processors are letting AI agents transact for consumers, creating security challenges that enterprise teams can learn to address from fraud teams.
An agent can use valid credentials and permitted access but still take an action that is illegitimate or outside the user's intent.
The commentary says security teams should assess an agent's behavior, context and intent, not rely only on identity and access controls.
It recommends limiting delegated authority by task, resource and duration and preserving records of how authority is passed between agents and systems.
- Who
- Enterprise security teams and CISOs, with fraud teams as a source of guidance.
- What
- The commentary argues that security teams should use fraud teams' methods to assess AI agents' behavior, context and intent, and limit their delegated authority.
- When
- Published October 12, 2026. Retailers, banks and payment processors are already allowing agents to transact.
- Where
- Across enterprise applications and systems, including retail, banking and payment processing.
- Why
- Agents can act with valid credentials and permissions without necessarily acting legitimately or as the user intended.
This story does not have two clearly opposing sides.
Enterprise identity security has focused on identifying people and determining what they are allowed to do.
Retailers, banks and payment processors are letting AI agents transact for consumers, prompting fraud teams to develop new ways to assess agent legitimacy and authority.
NIST warned that early agent deployments were repeating a pattern of prioritizing new capabilities and immediate business value over security.
- Publication date
- October 12, 2026
- Agent use
- Retailers, banks and payment processors are letting AI agents transact for consumers.
- Recommended limits
- Constrain permissions by task, resource and duration.
- Delegation records
- Preserve who initiated an activity, what authority was delegated and how it was used.
What people are saying
The harder question: What happens after authentication?
We need to make delegated authority specific and constrained.
Sources
Related news
Cyberattack defrosts refrigerators at French supermarket chains
Ledger confirms tampered wallets linked to CryptoBilis fund thefts
Malware incident at contractor may expose 8.7 million karaoke records
Identity systems are a key part of cyber recovery planning
Pentagon data breach affected more than 3 million people
Critical SonicWall flaw faces exploitation days after patch
Canadian cybersecurity executive arrested on federal extortion charges
Cyberattack disrupts refrigeration systems at French supermarkets
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Albert Heijn systems remain offline after cybersecurity incident
Attacks disrupt Yandex services and its data centers in Russia
