Asia-Pacific firms urged to govern AI agents better

SailPoint executive Eric Kong and ADP's Jessica Zhang have urged Asia-Pacific organisations to focus on governance and people as artificial intelligence moves deeper into everyday business operations.

The comments come as companies in ASEAN and Australasia scale up AI agents and workplace tools ahead of AI Appreciation Day.

AI agents have expanded rapidly across enterprise functions over the past year. Eric Kong, group vice president for ASEAN at identity security firm SailPoint, said AI systems are now active in customer service, software development, finance and operations, rather than remaining experimental pilots at the edge of IT.

Recent SailPoint research found that 82% of companies now use AI agents, and more than half allow them to access sensitive company information, often daily. Kong said that growth is changing how organisations should think about AI appreciation.

"Artificial intelligence has moved further and faster into the enterprise in the past year than perhaps any technology before it. Across the ASEAN region and globally, AI agents are no longer pilots running in the margins of IT; they are active participants in how work gets done, embedded across customer service, software development, finance, and operations. 82% of companies are now using AI agents, with more than half reporting they access sensitive company information, often daily. That speed calls for a sharper kind of appreciation, one that asks what it takes to trust AI agents with the access they now have," said Eric Kong, group vice president for ASEAN at SailPoint.

SailPoint's survey data suggests security leaders already see AI agents as carrying a distinct risk profile from more traditional machine identities.

"They are not simply faster versions of the machine identities enterprises already manage. 72% of security leaders believe AI agents pose a greater risk than traditional machine identities, largely because agents are provisioned faster, require broader access, and are harder to govern once live. 80% of organisations report their AI agents have already taken some action outside their intended scope, from accessing unauthorised systems to being prompted into revealing their own credentials. The investment is incomplete without governance built for how agents actually behave," Kong said.

Technology professionals in the study also described AI agents as an emerging security issue that requires clearer oversight.

"Most organisations already sense this. Technology professionals call AI agents a growing security consideration, with 92% saying governing them is critical. Yet only 44% have a governance policy in place, and awareness rarely travels beyond IT to compliance teams or executives. With non-human identities now growing twice as fast as human ones, and AI agents projected to be the fastest-growing identity type in the years ahead, closing that gap before growth compounds is urgent and solvable," Kong said.

Kong argued that as agentic systems expand, organisations should apply the same controls used for human privileged users to AI agents.

"In practice, it means treating every AI agent the way a well-run enterprise already treats a privileged employee: with a named human owner, a clear record of what it touched, and access that adjusts in real time. By moving toward zero standing privilege rather than leaving access open by default, organisations gain the visibility needed to catch a compromised credential before it escalates, and those without it often only find out after the damage is done. That is what appreciating AI actually requires: confidence built on visibility, not just enthusiasm for capability. The organisations that get the most from agentic AI won't be the ones that deployed the most agents fastest. They'll be the ones that knew, at every moment, who owned each agent, what it could reach, and how quickly they could act if something changed," Kong said.

While Kong focused on security and governance, Jessica Zhang, senior vice president for Asia Pacific at ADP, highlighted a widening gap between employee use of AI tools and their expectations of benefit.

"While businesses across Australia and New Zealand are moving AI from experimentation to everyday operations, AI Appreciation Day is a reminder that success will not be defined by the latest tools organisations adopt, but by how effectively they help people use them. ADP Research shows that 44% of Australian workers are already using AI at least multiple times a week, yet only 13% expect it to positively impact their job responsibilities in the year ahead. The disconnect highlights a challenge in trust and communication. Employees may be using AI, but many still don't understand how it will make their jobs better rather than simply different. The priority for local organisations now is to be more deliberate about how AI is applied. At ADP, we refer to this as "The Great Job Unbundling", identifying which tasks are best suited to AI, and which still require human judgement, creativity, context and collaboration. The organisations that get AI right won't necessarily be the ones adopting it fastest. They'll be the ones that invest just as heavily in people as they do in technology," Zhang said.