As AI agents spread across enterprise workflows, permission management is becoming one of the most practical levers for keeping them safe. Agents act with the access people give them, so the old problem of sprawling privileges now plays out at machine speed.
Governance is often cast as a brake on that momentum, especially as work platforms build agents into everyday tools. The view at monday.com Ltd., which relaunched as an AI work platform with native agents, is that well-designed guardrails let teams move faster, according to Ryan Nigro (pictured), security trust and enablement team lead at monday.com.
“The brakes on a car are not for you to be slowing down constantly,” Nigro said. “It’s so that you could feel confident in going faster.”
Permission management as the core of AI governance
Nigro’s approach rests on least privilege, a concept cybersecurity teams first applied to human users. AI largely does what employees already do, so haywire permissions for people become a problem for agents too, he explained. The fix is to roll out AI piece by piece, granting each tool the minimum access it needs and expanding as results prove out.
“You don’t want to enable all the features and give everybody all the access all at once. That’s just bad permissions,” Nigro said.
Everyday personnel moves create some of the biggest gaps. An employee who shifts from finance to legal can end up holding both departments’ access at companies without strict permission management, Nigro noted. He cited an IBM Corp. study estimating that 80% to 90% of breaches stem from human error tied to over-permissioning.
“It just comes to making sure that your users are properly being given just enough to do their roles but not too much to cause harm,” Nigro said. “There’s no reason why a sales rep should have the ability to change your production environment.”
