AI agents are gaining access to business applications, sensitive data and infrastructure, forcing security teams to reconsider access controls designed primarily for employees and managed devices.

New research from the IDC InfoBrief AI Drives New Access Control Requirements, sponsored by Portnox, found that three forms of AI agent access ranked among enterprise buyers’ leading access control priorities for 2026.

“AI usage and access” ranked first among zero-trust priorities at 14%, followed by “AI infrastructure” at 13%.

If that still depends on someone reviewing an alert and opening a ticket, an AI agent can keep working while the security team catches up.

Security teams must apply access rules consistently across these environments as AI agents move between applications, data and infrastructure.