| |
By Bill Murphy · Powered by Colony Spark |
THE OPERATIONS
BRIEF |
|
ISSUE #19 · AUGUST 14, 2026 |
|
| |
|
| |
|
Hi ${first_name},
The risk profile of business AI changes when an agent stops answering questions and starts crossing system boundaries. A model connected to ERP, CRM, email, file storage, and workflow tools does not just produce an answer. It can assemble records that were previously separated, act through credentials that outlive the task, and carry one compromised integration into several operating systems.
This issue is about the layer replacing traditional prompt review: system access mapping. The useful question is no longer only whether the output is correct. It is what the integration can reach, combine, and change.
Bill
|
| |
System Access Is Becoming the Hidden AI Risk.
The model is not the blast radius. The permission map is.
The first wave of business AI review centered on the model. Did it make up a fact. Did a person check the response. Could sensitive data appear in the prompt or answer. Those controls still matter, but they describe an assistant sitting on one side of a screen. Agents change the unit of risk.
|
Five signals from 2025 and 2026
· 16% of respondents were already using agents for multi-step workflows and multi-agent systems, while only 26% said leadership was clearly aligned on AI. Adoption is outpacing control (Microsoft 2026 Work Trend Index).
· 45 non-human identities exist for every human identity. These include service accounts, API keys, and secrets used by applications and automated systems. Agents use those identities to access sensitive systems and data (Cloud Security Alliance).
· Tool Misuse and Identity Abuse are now distinct risks in OWASP's Top 10 for Agentic Applications. An agent does not need an exotic exploit if it has legitimate access to export customer records, modify an order, send an email, or trigger a workflow (OWASP Top 10 for Agentic Applications).
· One compromised OAuth token associated with Salesloft Drift was used to export large volumes of Salesforce data. The same tokens provided access to connected Google Workspace accounts. One integration became the attack path across multiple systems (Google Threat Intelligence Group).
· 13% of breached organizations reported breaches of AI models or applications, and 97% of that group lacked proper AI access controls. Sixty percent of AI-related incidents led to compromised data and 31% caused operational disruption (IBM 2025 Cost of a Data Breach).
|
Microsoft's data shows the move into multi-step workflows is already underway, while leadership alignment trails behind. That work needs credentials. CSA's identity count shows how quickly those credentials disappear into a much larger population of service accounts, tokens, keys, and application identities. OWASP then identifies the failure that becomes possible: a tool can be misused while the agent remains inside the access it was granted.
The Salesloft Drift incident makes the operating consequence concrete. One connected application held OAuth paths into Salesforce and email. When the tokens were compromised, the response could not stop at reviewing the app. Customers had to trace every connected system, rotate credentials, and search the exported data for more secrets that could extend the breach again. IBM's findings show what happens when that control gap reaches AI systems: data loss and operational disruption, not just a bad response in a chat window.
For a manufacturer or distributor, the blast radius follows the workflow. An order-status agent may need ERP reads, customer emails, shipping documents, and workflow actions. A purchasing agent may touch supplier records, inventory, purchase approvals, and shared files. If each connection inherits a broad administrator or employee credential, the agent quietly becomes a bridge across controls that used to be separate.
|
Model review asks what the AI said. Access review asks what the entire connected workflow can do if the agent, token, source document, or integration is wrong.
|
|
|
| |
Companies are already exposed without realizing it.
Keren Katz, OWASP, on the visibility gap around deployed agents
|
“Companies are already exposed to Agentic AI attacks. Often without realizing that agents are running in their environments.”
|
Katz co-led the OWASP Top 10 effort that gathered input from more than 100 security researchers, practitioners, user organizations, and technology providers. Her statement reflects what most organizations are discovering right now: agents are already connected to business systems, moving data, and taking actions. The visibility gap is structural. Most agent reviews document the prompt, model, owner, and intended task. That leaves the operational exposure scattered across ERP roles, OAuth grants, shared accounts, API keys, email permissions, folder access, and workflow actions.
|
The takeaway
No single screen shows that an order-status agent can read margin data, retrieve files, send customer email, and update a case because each permission was approved in a different system. The operating risk is not visible until the permissions are mapped together.
|
|
|
| |
The Agent Blast-Radius Map.
One operating view before a useful integration becomes a shared point of failure.
Map the full reach before one agent becomes the shortest path through the business.
Most agent reviews document the prompt, model, owner, and intended task. That leaves the operational exposure scattered across ERP roles, OAuth grants, shared accounts, API keys, email permissions, folder access, and workflow actions. No single screen shows that an order-status agent can read margin data, retrieve files, send customer email, and update a case because each permission was approved in a different system. The Agent Blast-Radius Map pulls those connections into one operating view before a useful integration becomes a shared point of failure.
What the map shows
|
· The business job. Agent name, owner, intended task, and named business context.
· Connected systems and actions. ERP, CRM, email, file repositories, workflow tools. For each, whether the agent can read, create, update, delete, approve, send, export, or trigger.
· Credentials and ownership. Service account, API key, OAuth grant, shared identity. Who issued it, when it was created, when it expires, who owns it now.
· Sensitive data reached. Customer records, order data, pricing, supplier information, financial commitments. Data classification and approval thresholds.
· Gaps and risks. Permissions beyond the named job, credentials with no expiration, shared identities, unnecessary system connections, write access without approval gates.
|
How it works in practice
|
The mapping process
Step 1. Name the agent and the job. What is it called, who owns it, and what business work does it do. One agent, one job. If the agent touches multiple workflows, map them separately or consolidate the job definition first.
Step 2. List every system it touches. ERP, CRM, email, file storage, workflow automation, external APIs. For each system, record what permissions the agent holds: read, create, update, delete, approve, send, export, trigger.
Step 3. Trace the credentials. What identity does each connection use. Service account, API key, OAuth grant, shared account. Who owns it now, when was it created, when does it expire, what else can it reach in each system.
Step 4. Identify gaps. Compare actual access against the minimum needed to do the named job. Anything outside that path gets flagged: excessive read scope, write access without approval, unnecessary system, shared identity, credential with no expiration, inherited permissions from a previous workflow.
|
Building it: Two paths
|
Path 1: Internal build
Start with the three agents or copilots closest to customer orders, purchasing, inventory, finance, or production scheduling. Export enterprise-application grants from the identity provider, connected-app permissions from CRM, integration users and roles from ERP, mailbox delegation from the email platform, and service credentials from the secrets manager. Join them in a controlled table using the agent or service identity as the key. Add a fixed action vocabulary: read, create, update, delete, approve, send, export, trigger. Have the business owner confirm the minimum actions needed for the named job, then flag every mismatch. A spreadsheet, diagram, and monthly credential review are enough for the first version if one owner is accountable for keeping them current.
|
|
Path 2: ERP or partner build
Ask the ERP partner, systems integrator, or managed service provider to map the agent's complete transaction path rather than reviewing only the ERP role. The partner can pull integration users, role permissions, API scopes, workflow scripts, connected applications, and audit history from the systems it already manages, then join those records with identity-provider and email permissions. The useful deliverable is not another security report. It is a live operating map tied to order entry, purchasing, inventory, production, and customer communication, with named shutoff steps and a permission-change queue the internal team can review.
|
|
Treat every agent as its own worker identity. Give it only the systems and actions required for one named job. Make the combined reach visible before the workflow goes live.
|
|
|
| |
|
THE OPERATIONS BRIEF
By Bill Murphy · Powered by Colony Spark
|
|
Already mapping your agent access, or discovering agents connected to critical systems you did not know about. Hit reply, I read every one. Bill
|
|
| |
|