Artificial intelligence (AI) agents have the potential to accelerate federal missions, automate complex tasks, and help agencies make better use of their data. But agencies cannot safely expand agentic AI without first understanding the environments in which agents will operate.
In a preview to MeriTalk’s Aug. 27 Mission Room forum, “Agentic AI and the New Federal Workflow,” MeriTalk sat down with Brian “Stretch” Meyer, federal field chief technology officer at Axonius, a provider of unified security operations and exposure management solutions, to discuss the visibility gaps that can emerge as agencies deploy AI agents. Meyer also explores how continuous discovery, stronger security context, policy guardrails, and sound cyber hygiene can help agencies manage risk.
MeriTalk: Where do agencies face the most significant visibility gaps across devices, identities, applications, cloud assets, endpoints, and vulnerabilities as they introduce AI agents into mission workflows?
Meyer: This is true of any new technology. In the rush to get up and running, agencies may overlook the basics – understanding the devices, users, vulnerabilities, and applications in the environment.
Plenty of tools provide visibility, but each one is a silo of data. One may support security, while another supports operations. Different teams may be using different tools, and they are not always collaborating or sharing what they know.
The biggest gap I see is with permissions. AI access is often based on the permissions of the person using it, and many organizations do not realize how overprovisioned their users already are. Once people begin querying AI at scale, they may discover that users can reach HR systems or other sensitive records that they shouldn’t be able to access.
MeriTalk: How can agencies build a continuously updated view of the environments where AI agents operate?
Meyer: Agencies need to treat AI agents as part of the cyber asset ecosystem, not simply as applications or experiments. They need continuous discovery that shows where agents are deployed; which tools, APIs, software-as-a-service applications, cloud services, and data repositories they can access; and which identities, service accounts, tokens, or credentials they are using.
Traditional inventories are often point-in-time snapshots. Agentic AI requires a living operational map because agents can connect to new systems, call new APIs, inherit new permissions, and interact with different data over time.
Agencies need to track how those relationships change. An agent may begin with one purpose and one set of permissions, but its access can expand as teams add capabilities or connect it to additional systems.
The National Institute of Standards and Technology’s AI Risk Management Framework addresses governing, mapping, measuring, and managing AI risk. The mapping function becomes especially important here. If an agency does not know where its agents are running and what they can touch, it cannot effectively govern their behavior.
MeriTalk: What security context do IT and cyber teams need to assess whether an AI agent’s actions are expected, risky, or potentially malicious?
Meyer: Successful authentication is no longer enough. Agencies also have to ask whether the authenticated agent is behaving appropriately for its approved purpose. A single action may look harmless on its own, but risk increases with the combination of identity, privilege, asset criticality, data sensitivity, mission context, and behavior.
Teams need to know which human, service account, workload identity, or delegated authority the agent is acting under. They also need to compare what the agent is authorized to do with what it is actually doing.
Then they need asset and data context. Is the agent touching a mission system, production database, high-value asset, or sensitive part of the network? Is it accessing controlled unclassified information, personally identifiable information, source code, credentials, or operational logs?
Behavior is a major factor. Existing monitoring tools were largely built around human activity, but agents can accelerate a person’s workload by 10, 20, or even 50 times. A user may have legitimate access, but the speed and volume of activity can make it difficult to determine whether the behavior is expected or whether a malicious actor has compromised the identity and is using the agent to expedite its work.
MeriTalk: How can agencies enforce policy and maintain appropriate human oversight as agents interact with systems and data across distributed environments?
Meyer: The human in the loop has to become policy in the loop. Human oversight cannot mean manually reviewing every action because that will not scale at the speed agents operate.
Agencies need policy boundaries that define when an agent can act autonomously, when it needs approval, and when it must be blocked. In a security operations center, for example, an agent could deduplicate tens of thousands of identical alerts, summarize the issue, and then ask a human whether it should block the activity. The agent handles the volume, while the human approves the sensitive action.
Policy enforcement should also include least privilege and separation of duties. Agents should have only the access required for their mission task, and they should not be able to both recommend and execute sensitive changes without oversight.
Agencies also need real-time monitoring after deployment. Too often, teams focus on getting an agent approved and connected but do not maintain the same level of visibility once it is operating.
They should have a kill switch or containment process as well. Security teams need to be able to revoke access, disable credentials, or isolate an agent quickly. Every action should also be traceable to an owner, identity, policy, and purpose.
The goal is not to slow AI down. It is to let agents move quickly inside clearly defined guardrails.
MeriTalk: What practical steps can agencies take now to strengthen asset visibility and exposure management before beginning or expanding agentic AI deployments?
Meyer: Before agencies deploy AI, they need to assess how confident they are in the asset visibility and exposure management they already have. Do they have a reliable asset inventory? Do they understand their vulnerabilities, users, applications, cloud services, and API connections?
Agencies should not wait until agents are deployed to discover gaps in visibility, identity, permissions, or exposure. The safest path is to strengthen the foundation first.
That means building a complete inventory across cloud, on-premises, and software-as-a-service environments, then mapping the relationships among assets, identities, data, and permissions. The question is not only, “What do we own?” It is also, “What can communicate with what, and who or what has access?”
That understanding makes it easier to create an onboarding checklist for each agent. Every agent should have an owner, an approved purpose, defined data and system boundaries, an escalation path, and logging requirements.
We are reaching the point where agencies need to treat an agent as both a new system and a new user. Agents perform human-type functions, but they also connect to the network like technology. Agencies have to blend those two governance models.
The agencies that succeed with agentic AI will not simply be the ones that deploy it fastest. They will be the ones that understand their environments well enough to let agents operate safely, detect when behavior deviates from intent, and enforce policy in real time.