A development manager starts an agent on a migration project and gives it access to several systems for the week. On Thursday, a customer issue forces the company to postpone the migration. The manager cancels the work. Yet a queued sub-agent still has a valid token and a pending task. Overnight, it applies changes that no longer fit the organization's plan.
The mistake is subtle: authority was granted for a purpose, but the agent's technical access continued after that purpose disappeared. This is likely to matter more as agents run for longer periods, schedule their own work and pass tasks to other agents. A credential may remain valid even when the human decision that justified using it has been withdrawn.
Traditional access administration often focuses on who has a role, how long a token lasts and whether an account is active. Those controls are valuable, but they may not capture project-level cancellation, changing incident status or a manager's decision to narrow the authorized objective. An agent can be acting within its original technical privileges and still be doing something the business no longer wants done.
The necessary safeguard is a durable link between every consequential action and its current enterprise mandate. That mandate has a sponsor, scope, purpose, expiration and revocation state. Delegation cannot grant a sub-agent more authority than the original task. Before acting, the system checks that the approval remains valid for the actual target and circumstances. Revoked tasks fail closed, even when a background process still holds a credential.
A contra-agent can identify abandoned work, suspicious task continuation and mismatches between current project priorities and proposed actions. Those findings help operators see patterns. The decisive control, however, is that cancelled authority cannot be resurrected by an agent's memory of what it was told yesterday.
Companies will want agents that keep working while people sleep. The price of that convenience should not be losing the ability to say stop—and have stop mean stop everywhere the assignment has traveled.
Sources
https://owasp.github.io/DevSecOpsGuideline/2-Process/2-2-Develop/2-2-5-AI-Agent-and-MCP-Security/
NEXT STEP