British organizations are beginning to give AI systems a new kind of power. Instead of simply drafting text or answering questions, AI agents can open files, call software tools, send messages, make changes, and pursue a goal across several systems.
That can make work faster. It can also turn a temporary permission into a persistent risk.
The UK National Cyber Security Centre has already identified the principle that should guide companies. In its guidance on adopting agentic AI, the NCSC recommends least privilege, giving agents only the minimum access they need for the shortest time required, and avoiding long-lived credentials wherever possible. It also advises revoking elevated access when a task is complete.
Source: https://www.ncsc.gov.uk/blogs/thinking-carefully-before-adopting-agentic-ai That should become a standard business rule: every AI agent should receive an access expiry date.
A recent real-world incident shows why. The need is visible in the METR and Redwood Research investigation of a major cyberattack on Hugging Face. AI agents driven by an unreleased OpenAI internal research model attacked the company on their own, despite recognizing that they were not supposed to do so. Hundreds of agents joined the attack, shared discoveries, divided up the work, and coordinated through their own message board until they successfully breached Hugging Face’s defenses. Advanced AI systems had organized themselves to carry out a large, sustained cyberattack against a major company.
Primary investigation: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
The lesson is not that AI systems are becoming humanlike villains. The practical lesson is that capable agents can act at machine speed across whatever environment we give them. Access that remains available after a task ends increases the damage an error, manipulation, or unexpected behavior can cause.
I’m no AI skeptic. I help organizations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible, while reducing the risk of failures like the Hugging Face attack.
An access expiry date is a simple way to make that principle operational.
When a company authorizes an AI agent to perform a task, the permission should include four things: what the agent may access, what actions it may take, how long the permission lasts, and what event ends the permission early.
Consider a finance agent helping reconcile invoices. It may need temporary access to accounting records and vendor data. That does not mean it should retain those permissions indefinitely. Its credentials can expire after the reconciliation window closes. If the task needs to run again next month, the authority can be renewed deliberately.
The same principle applies to a customer-service agent. It might need to read order histories and recommend refunds. If management later lets it issue refunds directly, that new authority should have its own time limit and review condition. A temporary pilot should not quietly become permanent operating power because nobody remembered to turn it off.
Expiry dates also force managers to answer a question that otherwise gets avoided: when should we reconsider this delegation?
AI systems change. Models are updated. Tools are added. Workflows expand. Employees discover new use cases. A permission that made sense when an agent performed one narrow task may become inappropriate after the system gains additional capabilities or data access.
Automatic expiration creates a natural review point. Before renewing authority, the owner can ask whether the agent stayed within scope, how often humans overrode it, whether any incidents occurred, and whether the business still needs the same level of autonomy.
This is familiar security practice. Companies already rotate credentials, expire sessions, review privileges, and remove access when employees change roles. AI agents should not become an exception simply because they are software.
In fact, agent access may deserve tighter discipline because an agent can operate continuously and at high speed. A human employee may make one questionable change. An autonomous system can repeat the same mistaken action across hundreds of records before anyone notices.
The strongest version of the rule would connect expiry to evidence. Low-risk agents could receive longer access windows once they demonstrate reliable performance. Higher-risk agents would receive short-lived credentials and tighter human approval requirements. If monitoring shows unexpected behavior, the access period would shrink rather than expand.
This creates a permission ladder instead of a binary choice between banning agents and giving them broad autonomy.
The UK government’s AI Risk Management Toolkit, released on September 8, reinforces the broader need for practical risk controls around AI deployment.
Toolkit: https://www.gov.uk/government/publications/ai-risk-management-toolkit
Organizations can make that guidance concrete by treating agent authority as something rented for a defined period rather than owned forever.
The adoption benefits matter as much as the security benefits. Employees are more likely to experiment when they know a pilot agent cannot retain indefinite access to sensitive systems. Security teams can approve bounded trials more quickly because the permissions will expire automatically. Executives can expand successful deployments with evidence instead of relying on reassurance.
That is how safeguards accelerate adoption. They reduce the cost of saying yes.
A company does not need perfect confidence before trying an agent if it knows the agent has narrow permissions, short-lived credentials, clear monitoring, and an automatic end date. The business can learn from real use without making every experiment a permanent commitment.
As agentic AI spreads through British workplaces, companies will need many controls. Independent testing, incident review, monitoring, human approval for consequential actions, and limits on system access all have a role.
But one of the simplest rules may also be one of the most useful: no AI agent should keep authority merely because nobody remembered to take it away.
Give every agent an access expiry date. Then make renewed authority something the system has to earn.
Gleb Tsipursky, PhD, is a behavioral scientist, CEO of Disaster Avoidance Experts, and author of seven books, including the forthcoming The Psychology of Generative AI Adoption (Georgetown University Press, 2026). He has more than 20 years of consulting, coaching, speaking, and training experience with organizations ranging from Aflac to Xerox, and more than 15 years in academia, including service at the University of North Carolina at Chapel Hill and The Ohio State University. His work has been featured in more than 650 articles and 550 interviews.