TL;DR
An IBM survey of 2,000 C-level executives found only 11% feel fully prepared for AI agent deployment. PromptHalo founder Madhuri Chandoor argues the core issue is distinguishing capability from authority. Her refund-splitting example shows how agents can circumvent per-action limits through sequential requests. She advocates behavioral profiling for AI agents (modeled on financial fraud monitoring) and documenting what agents can access, under what conditions, and what downstream effects are possible.
A 2026 IBM study points to questions about AI readiness, visibility, and control. The survey of 2,000 C-level technology executives found 11% felt fully prepared for the AI-agent deployment expected over the following year. Two-thirds of CIOs and CTOs said they were accountable for AI systems they did not fully control, while 70% said teams were deploying technology faster than IT could track. IBM presented the findings as an indication of a growing control gap as AI use expands across businesses.
The distinction between capability and authority is central to how Madhuri Chandoor, founder of PromptHalo, approaches that control gap. She describes PromptHalo as an AI security and trust infrastructure company that inspects why a certain action is being performed, rather than just inspecting what is being performed. According to Chandoor, the approach is intended to give organizations more contextual information about whether an action reflects user intent, assigned permissions, and the surrounding circumstances before a system proceeds.
One hypothetical enterprise database task illustrates the concern Chandoor raises about context. She says that an infrastructure-managing AI agent asked to improve application performance might add or remove an index or change the table structures autonomously in a production environment. In her example, that action could affect live transactions, customer data, or dependent processes that were outside the agent’s immediate analysis. “A technical conclusion can appear reasonable within a narrow focus,” Chandoor says. “The context, the situation, and the downstream impact still need to be considered before an action proceeds.”
Earlier chatbots, in Chandoor’s account, generally operated within predetermined questions and answers. She says with large language models we are now using broader company information and tools that increase the exposed risk surface, leading businesses to consider how incoming requests could influence a system. She recommends that security teams examine how a request is interpreted and what level of authority connected systems provide before an agent proceeds.
Chandoor uses a refund scenario to explain why context may span several actions. In her example, an agent may issue refunds up to $50 without human review. A user then requests ten $50 refunds rather than one $500 refund requiring review. Chandoor says each transaction could appear permissible when examined individually, while the sequence may suggest an effort to avoid the threshold. From her perspective, reviewing broader session context and behavior could help identify when escalation for human review may be appropriate.
Drawing on two decades in financial services, Chandoor compares her approach with fraud monitoring across transactions and accounts. She suggests organizations develop behavioral profiles for autonomous agents alongside the identity and access permissions. Under her proposed model, teams would review the resources an agent accesses, its use of tools, changes in its activity over time, and actions that appear inconsistent with its assigned role or the circumstances of a session.
Questions about authorization should be considered during both design and operation, Chandoor says. In her view, teams benefit from documenting the resources an agent may access, the conditions that apply to that access, and the possible downstream effects of particular actions. She also recommends observability gates to review activity, particularly to inspect and address when requests become repeated, unusually broad, or inconsistent with the purpose originally assigned to the agent. Those checkpoints, Chandoor explains, can help contain the impact and determine what additional controls are required to secure underlying systems.
Chandoor emphasises her position as support for responsible AI adoption. She favors using agentic automation for analysis and workflows but applying additional verification when the impact involves critical decisions and actions. “Trust, but verify,” she says.
“Businesses should adopt AI responsibly and verify its behavior throughout the process,” she says. “Establishing clear accountability ownership across the organizations for AI applications security is essential to operationalise these guardrails.” In her view, that approach may help businesses pursue AI innovation while giving security and accountability the necessary attention.
Credit: Canva