The Cost of Impact: What One Wrong AI Agent Action Is Worth
Frontier AI cut the cost of attack. AI agents raised the cost of impact. Contain it by deciding each action before it runs, not reporting it the next morning.
AI Agents Change the Economics of Impact
It's 11pm. A developer asks a coding agent to fix a failing data pipeline. The agent connects to Snowflake, decides a table is in the way, and runs DROP TABLE.
The table was production.
No one attacked anything. No credential was stolen. The agent did what the developer's access allowed, in less time than it takes to read this sentence. By morning, the finding is accurate, well-formatted and too late.
This is the other half of the AI security problem.
AI broke security's economics in three places
Security has always been an economic contest. Three costs decide who wins: what it costs to attack you, what it costs to defend, and what one bad event costs when it lands.
AI moved all three at once.
- The cost of impact rose. AI agents now act inside your business systems with real authority, at machine speed, in numbers no one planned for.
- The cost of attack fell. Frontier models can now read an unfamiliar permission model and chain five low-severity findings into one catastrophic path, for pennies. We covered that in Frontier AI Changes the Economics of Cyberattacks.
- The cost of defense is under pressure. Every new agent platform is another system to learn, monitor and control.
This post is about the first one. What can AI do inside your company, and what is one wrong action worth?
Every team raced to put AI to work
It started with productivity, and it's working.
Sales uses agents to research accounts and update the CRM. Finance uses them to gather data and prepare recurring reports. Developers use them to write code and investigate issues. IT and DevOps use them to automate tickets and operate systems.
No one standardized. Business teams picked Copilot Studio. Automation teams picked n8n. Developers picked Claude Code and Codex. DevOps picked Bedrock AgentCore. Others brought in tools no one approved.
Different teams. Different platforms. The same business systems. Every one of those agents ends up in Salesforce, Snowflake, Databricks, Workday, NetSuite, GitHub and ServiceNow. That's where the work happens and where the data lives.
Then a second wave arrived. The business systems started shipping agents of their own. Vendors switch on built-in agents and AI features, and let users create agents inside the app. Often there's no security review, and no single way to monitor or control any of it.
By the time Security gets the call ("can you make sure all of this is safe?"), thousands of agents may already exist. Gartner predicts 40% of enterprise apps will include task-specific AI agents by the end of 2026, up from less than 5% in 2025.
Impact used to be rate-limited by people
For decades, the cost of impact had a natural ceiling. It was set by human speed and judgment.
A database admin could drop a production table. In practice they rarely did, and never by accident at 3,000 queries a minute. A salesperson could export the full customer list. In practice they hesitated, or someone noticed. Most access was broader than it needed to be. That was tolerable, because people used a small fraction of it, slowly, with a sense of what they shouldn't touch.
Agents remove the ceiling.
An agent acts with the access of the person or service account behind it. It holds every permission that account already holds, and it doesn't hesitate. It acts in seconds, it can be misled by a prompt, and it doesn't know which table matters.
The result is a new kind of exposure. It's not a breach. It's an authorized action with an unauthorized outcome:
- Sensitive data leaves, through an MCP tool no one reviewed.
- Records are destroyed, and they can't be recovered.
- Admin access spreads. An agent running on admin credentials gives admin reach to everyone who can invoke it.
Over-permissioning used to be a hygiene issue. With agents, it's the blast radius.
The controls we have report the damage; they don't contain it
The market's first answer has been visibility: inventory every agent, score its access, file a finding. That's necessary, and it's step one. But an inventory tells you an agent exists. It can't stop the command that agent is about to run.
A finding reviewed the next morning arrives after the data has left or the table is gone. If agents act at machine speed, the control has to sit where the action happens.
The second answer has been rules inside each tool. Those decide on partial facts. The agent runtime sees a valid session, but it doesn't know HR terminated that user at 9am. The gateway sees SQL, but it can't tell a production table from a test table. The app enforces account permissions, but it has never seen your data classification labels.
A rule that sees only the request has two bad options. It blocks too much, so the business routes around Security. Or it misses the one action that does the damage.
Then the same rule gets copied into every runtime, gateway and app, and the copies drift.
Authority is a chain, not a lookup
Our view is that AI agent risk is an authority problem, and every agent action deserves a runtime decision.
When an agent acts, its authority runs through a chain. A person and their role delegate to an agent. The agent uses a token with a scope. The token calls a tool, the tool takes an action, and the action touches a business object. Each link can change independently:
- The person's role changes, and their access doesn't follow.
- The agent inherits more reach than anyone intended.
- The token's scope expands quietly over time.
- The tool runs whether the chain still holds or not.
- The data's true sensitivity is invisible upstream.
Decide on one link and you're deciding on partial facts. The right question is "should this action proceed, right now?" Answering it takes identity, HR status, app permissions and data sensitivity, evaluated end to end, for that specific action.
The same DROP TABLE is routine on a test table and an incident on production. Containing the cost of impact means knowing the difference before the agent runs it.
Containing the cost of impact takes four things
If that's the shape of the problem, the requirements follow. Each one keeps a cost from growing with the number of agents.
1. Control: know who can cause what. Resolve the user, agent, tool, credential, app and effective authority behind each action. Then a policy fires only when it should, and useful work continues.
2. Scale: decide only what needs judgment. Security can't review thousands of agents by hand, and often lacks the business context anyway. Decide “the many” automatically when context and policy are clear. Route “the some” to agent owners to fill in what's missing. Escalate only the few true exceptions.
3. Consistency: say it once, enforce it everywhere. Write one business policy, such as "any agent changing payroll data requires human approval." Then apply that same decision in the agent runtime, the MCP gateway, the API gateway and the app. One rule, many enforcement points, and no copies to drift.
4. Continuous assurance: prove it's still true tomorrow. Approval is a moment. Credentials gain scope, agents gain tools, behavior shifts and controls get bypassed. Yet the agent still says "approved." Detect that drift continuously, and bring people back in only when something material changed.
The goal: let agent use grow without governance cost growing with it
Put those together and you get a decision layer: one place that weighs identity, authority, business context and risk, for every agent action against your third-party apps.
The outcomes are simple:
- A sales agent summarizes opportunity history: allow.
- A dev agent deletes a production repository: block.
- A support agent exports the full customer list: require approval.
Each decision is recorded with its context. When the board or an auditor asks what your AI agents did, you have the answer.
This is how Security becomes the reason the company can say yes to more agents, not the reason it can't. That matters. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027, and it names inadequate risk controls as one cause.
Two sides of the same coin
Frontier AI and AI agents look like separate problems. They're the same problem viewed from two directions.
Both exploit the same raw material: authority in third-party apps that no one evaluates end to end. Both are defeated by the same move, which is understanding that authority as a connected chain and acting on it at the right moment. A frontier attacker who lands a foothold becomes, in effect, another agent acting on borrowed authority. Cap what one action can do, and you cap what that foothold is worth.
Where this leaves us
The companies that scale AI agents fastest won't be the ones with the fewest agents. They'll be the ones that can let thousands of agents act, and still stop the one action they can't afford.
That's a decision, made at the moment of the action, with the whole chain of authority in view.
The cost of impact is the one you can still control.
Come watch a live walkthrough of how Obsidian decides every AI agent action before it runs. Weekly demo
