Governance Isn't Security When AI Agents Can't Use Judgment with Jake Williams

Enterprises have spent decades writing governance policies that quietly assumed a human would exercise judgment at the final step. Jake Williams, VP of R&D at Hunter Strategy and a faculty analyst at IANS Research, argues that assumption collapses the moment autonomous agents enter the picture. Agents do not use discretion and cannot be held accountable the way an employee can, which turns the implied trust at the bottom of every access control list into a liability. The result is a widening gap between what organizations govern on paper and what they can actually enforce at machine speed. Williams makes the case that the legacy problems security teams tolerated for years, coarse data classification and unresolved entitlements debt chief among them, are now being exposed by the speed and scope of AI-driven activity. He walks through why volumetric detection matters more than signatures against agent-scale behavior, why every deployed agent needs a named business owner who is accountable for its actions, and how his open framework CUSTODY gives teams a shared taxonomy to classify and contain agents before they ship. The conversation closes on the economics most organizations are avoiding, from the true cost of tokens to the 15-30% security premium of screening for prompt injection.

For links and resources discussed in this episode, please visit our show notes at: https://www.forcepoint.com/resources/podcast/ai-governance-enforcement-gap For readers who want to go deeper, Williams references 1Password research on why AI-generated vulnerability patches still require expert human review and a Microsoft Entra analysis of why OAuth must evolve to support AI agents.