BeyondTrust Puts Agent Permissions Under the Microscope

On October 21, BeyondTrust announced general availability of AI Agent Security, which it says can distinguish agent actions from a person’s and enforce permissions at runtime. The company also reported that, in its sampled endpoint telemetry, coding agents requested about 1.28 million shell commands across 132,000 prompts. Those were requests—not necessarily successful executions—and the sample was not presented as a measure of all organizations.

The useful shift is treating an agent as its own operational identity, rather than assuming a person’s permissions should automatically travel with it. That could make delegated work easier to govern, but a control is only as dependable as its policies, exceptions and recovery path. Before adopting a tool like this, I’d ask who maintains those rules and how teams verify that legitimate work still gets through. Where should human approval be required—and where is a narrower, pre-approved permission enough?