Policy-Driven Access Control for Secure Deployment of Autonomous AI Agents in Enterprise Environments
DOI:
https://doi.org/10.22399/ijcesen.5497Keywords:
autonomous AI agents, policy-driven access control, enterprise security, least privilege, role-based access control, human-in-the-loopAbstract
The growing adoption of autonomous artificial intelligence agents in enterprise environments introduces significant security challenges because such agents can independently access data, invoke tools, execute workflows, and interact with multiple organizational systems. This study evaluates a policy-driven access-control framework designed to regulate autonomous agent behavior through least-privilege authorization, contextual policy evaluation, risk-adaptive enforcement, human approval, and comprehensive audit logging. A controlled enterprise simulation was developed to compare minimal control, conventional role-based access control, and policy-driven access control across security and operational performance indicators. The policy-driven framework reduced privilege exposure ratio to 0.17 ± 0.04, unauthorized action rate to 2.65 ± 2.25%, and privilege-escalation success to 1.46 ± 1.37%, while increasing malicious-action blocking to 97.61 ± 1.49%, policy-enforcement accuracy to 96.05 ± 1.67%, and audit completeness to 98.92 ± 0.86%. Privilege exposure was strongly positively correlated with unauthorized action rate (r = 0.91), and regression analysis identified privilege exposure as the strongest positive predictor of unauthorized behavior (β = 0.507, p < 0.001), whereas policy strictness exerted a significant negative effect (β = −0.429, p < 0.001). Although policy-driven enforcement increased authorization latency to 68.86 ± 9.41 ms and slightly reduced legitimate task completion to 90.92 ± 2.82%, the overall security gains substantially outweighed the operational overhead. The findings demonstrate that policy-driven access control can provide an effective and scalable security foundation for autonomous AI agents by balancing operational autonomy with enterprise governance, accountability, and risk containment.
References
1. Acharya, D. B., Kuppan, K., & Divya, B. (2025). Agentic AI: Autonomous intelligence for complex goals—A comprehensive survey. IEEe Access, 13, 18912-18936.
2. Hughes, L., Dwivedi, Y. K., Malik, T., Shawosh, M., Albashrawi, M. A., Jeon, I., ... & Walton, P. (2025). AI agents and agentic systems: A multi-expert analysis. Journal of Computer Information Systems, 65(4), 489-517. DOI: https://doi.org/10.1080/08874417.2025.2483832
3. Bandi, A., Kongari, B., Naguru, R., Pasnoor, S., & Vilipala, S. V. (2025). The rise of agentic ai: A review of definitions, frameworks, architectures, applications, evaluation metrics, and challenges. Future Internet, 17(9), 404. DOI: https://doi.org/10.3390/fi17090404
4. Igwe-Nmaju, C. (2024). Organizational communication in the age of APIs: integrating data streams across departments for unified messaging and decision-making. International Journal of Research Publication and Reviews, 5(12), 2792-2809.
5. Adabara, I., Olaniyi Sadiq, B., Nuhu Shuaibu, A., Ibrahim Danjuma, Y., & Maninti, V. (2025). Trustworthy agentic AI systems: a cross-layer review of architectures, threat models, and governance strategies for real-world deployment. F1000Research, 14, 905. DOI: https://doi.org/10.12688/f1000research.169927.1
6. South, T., Marro, S., Hardjono, T., Mahari, R., Whitney, C. D., Chan, A., & Pentland, A. (2025, July). Position: AI Agents Need Authenticated Delegation. In ICML (Position Papers).
7. Acharya, D. B., Kuppan, K., & Divya, B. (2025). Agentic AI: Autonomous intelligence for complex goals—A comprehensive survey. IEEe Access, 13, 18912-18936. DOI: https://doi.org/10.1109/ACCESS.2025.3532853
8. Kalejaiye, A. N., & Shonubi, J. A. (2025). Zero trust enforcement using microsegmentation, identity-aware proxies, and continuous adaptive risk assessment in multi-tenant cloud environments. Int J Comput Appl Technol Res, 14(7), 61-77.
9. Saidur, M. J. I., & Khan, M. K. (2023). Automating NIST 800-53 control implementation: A cross-sector review of enterprise security toolkits. ASRC Procedia: Global Perspectives in Science and Scholarship, 3(1), 160-195. DOI: https://doi.org/10.63125/prkw8r07
10. Qiu, J., Tian, Z., Du, C., Zuo, Q., Su, S., & Fang, B. (2020). A survey on access control in the age of internet of things. IEEE Internet of Things Journal, 7(6), 4682-4696. DOI: https://doi.org/10.1109/JIOT.2020.2969326
11. Wylde, V., Rawindaran, N., Lawrence, J., Balasubramanian, R., Prakash, E., Jayal, A., ... & Platts, J. (2022). Cybersecurity, data privacy and blockchain: A review. SN computer science, 3(2), 127. DOI: https://doi.org/10.1007/s42979-022-01020-4
12. Dennis, L. A., Fisher, M., Lincoln, N. K., Lisitsa, A., & Veres, S. M. (2016). Practical verification of decision-making in agent-based autonomous systems. Automated Software Engineering, 23(3), 305-359. DOI: https://doi.org/10.1007/s10515-014-0168-9
13. Huang, K., & Hughes, C. (2025). Deploying Agentic AI in Enterprise Environments. In Securing AI Agents: Foundations, Frameworks, and Real-World Deployment (pp. 289-319). Cham: Springer Nature Switzerland. DOI: https://doi.org/10.1007/978-3-032-02130-4_10
14. Krishnan, N. (2025). Ai agents: Evolution, architecture, and real-world applications. arXiv preprint arXiv:2503.12687.
15. Uddin, M., Islam, S., & Al-Nemrat, A. (2019). A dynamic access control model using authorising workflow and task-role-based access control. Ieee Access, 7, 166676-166689. DOI: https://doi.org/10.1109/ACCESS.2019.2947377
16. Zhang, K., Su, Z., Chen, P. Y., Bertino, E., Zhang, X., & Li, N. (2025). LLM agents should employ security principles. arXiv preprint arXiv:2505.24019.
17. Kshetri, N. (2025). Transforming cybersecurity with agentic AI to combat emerging cyber threats. Telecommunications Policy, 49(6), 102976. DOI: https://doi.org/10.1016/j.telpol.2025.102976
18. Carpenter, D., & Krause, G. A. (2015). Transactional authority and bureaucratic politics. Journal of Public Administration Research and Theory, 25(1), 5-25. DOI: https://doi.org/10.1093/jopart/muu012
19. Farhadighalati, N., Estrada-Jimenez, L. A., Nikghadam-Hojjati, S., & Barata, J. (2025). A systematic review of access control models: Background, existing research, and challenges. IEEE Access, 13, 17777-17806. DOI: https://doi.org/10.1109/ACCESS.2025.3533145
20. Esen, F. S. (2025). The Risks of Agentic Al: The Curse of Autonomy. The Age of Generative Artificial Intelligence, 156.
21. Berthod, O., Grothe-Hammer, M., Müller-Seitz, G., Raab, J., & Sydow, J. (2017). From high-reliability organizations to high-reliability networks: the dynamics of network governance in the face of emergency. Journal of Public Administration Research and Theory, 27(2), 352-371. DOI: https://doi.org/10.1093/jopart/muw050
22. Thota, M. R. (2019). Policy-driven automation for scalable governance in enterprise big data platforms. International Journal of Scientific Research & Engineering Trends, 5(6).
23. South, T., Nagabhushanaradhya, S., Dissanayaka, A., Cecchetti, S., Fletcher, G., Lu, V., ... & Pentland, A. (2025). Identity management for agentic AI: The new frontier of authorization, authentication, and security for an AI agent world. arXiv preprint arXiv:2510.25819.
24. Jeyakumar, S. K., Ahmad, A. A., & Gabriel, A. G. (2024, December). Advancing agentic systems: Dynamic task decomposition, tool integration and evaluation using novel metrics and dataset. In NeurIPS 2024 Workshop on Open-World Agents.
25. Koubaa, A. (2025, October). From pre-trained language models to agentic AI: evolution and architectures for autonomous intelligence. In International Conference on Artificial Intelligence and its Applications in the Age of Digital Transformation (pp. 351-373). Cham: Springer Nature Switzerland. DOI: https://doi.org/10.1007/978-3-032-22032-5_24
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2025 International Journal of Computational and Experimental Science and Engineering
This work is licensed under a Creative Commons Attribution 4.0 International License.
