Security research on agentic deployments keeps arriving at the same short list, which is a good sign for the list and an awkward one for the industry. The controls identified as absent are not exotic. They are inventory, least privilege, egress control and audit — four things every mature security programme believes it already does.
Inventory, and why it decays
An agent inventory is harder to maintain than a server inventory for a structural reason: agents are created by far more people, through far more routes, at far lower cost. A platform feature enabled during an upgrade creates agents. A team automating an internal process creates agents. None of these paths necessarily crosses a register, and each new integration multiplies rather than adds.
Inventories built by one-off discovery are stale within a quarter. The ones that hold are wired into the creation path, so that an agent cannot reach production without being registered.
Least privilege against a moving target
Least privilege assumes you can enumerate what a principal needs. An agent's requirements depend on the task it is given, which varies per invocation. Scoping to the union of everything it might ever need reproduces the over-permissioning the principle exists to prevent; scoping tightly breaks the agent on the first unanticipated task.
The resolution is per-task credentials: a scope derived from the delegation and expiring with it. Few identity systems express this natively, which is why organisations end up building it in the agent framework rather than in the directory.
Egress control as the compensating control
Where authorisation cannot be made precise enough, constraining where data can go becomes the control that limits the damage. An agent that can read broadly but can only write to two known destinations has a bounded worst case. One that can read broadly and reach arbitrary network endpoints does not.
This is unglamorous network engineering and it is frequently the highest-leverage change available to a team that cannot rebuild its authorisation model this quarter.
Audit that supports an actual investigation
Most agent logging records what happened. Investigation requires knowing why: what the agent had in context, which tool it chose, on what basis, and what it did with the result. Without that, a reviewer can list the actions and cannot explain any of them.
The objection is volume, and it is a real one — full context logging is expensive and carries its own data-protection exposure, since the logs contain everything the agent saw. Most organisations land on retaining full context for a short window and decision metadata for longer, which is a reasonable compromise provided it is a decision rather than an accident.