monday. com Ltd., relaunched as an AI work platform with native agents, links safe deployment of AI agents to strict permission management. Security trust and enablement team lead Ryan Nigro described well-designed guardrails as a way for teams to move faster rather than slow down. He cited an IBM Corp. study estimating that 80% to 90% of breaches stem from human error tied to over-permissioning. For companies embedding agents in everyday workflows, the message is that access control becomes a direct enabler of speed.
Least privilege as the deployment rule
Nigro outlined the position during an interview with theCUBE's Rebecca Knight at monday. com's Elevate event, broadcast by SiliconANGLE Media's livestreaming studio theCUBE. The discussion focused on permission management as the core of AI agent safety. Agents act with the access people give them, so sprawling privileges now operate at machine speed. Governance is often viewed as a brake on momentum as work platforms add agents to everyday tools.
The method centers on least privilege, a concept cybersecurity teams first applied to human users. Since AI largely does what employees already do, excessive permissions for people become a problem for agents as well. Nigro advised against enabling all features and granting broad access at once, calling that approach bad permissions. Instead, companies should roll out AI piece by piece, granting each tool the minimum access it needs and expanding only as results prove out.
Everyday personnel moves create some of the largest gaps in this model. An employee who shifts from finance to legal can retain access to both departments at companies without strict permission management. Nigro said users should receive just enough access to perform their roles without enough to cause harm. As an illustration, he said there is no reason for a sales representative to have the ability to change a production environment.
What controlled access means for AI adoption
For companies using AI agents in shared work platforms, the practical consequence is a narrower initial scope with faster subsequent expansion. A team might start an agent with read access to selected boards or documents, then add write or cross-department actions after stable performance. That sequence reduces the blast radius if an agent misinterprets instructions or inherits outdated rights. Small firms gain a simple rollout checklist, while large firms gain a repeatable way to add departments without reworking controls each time.
The limitation to verify is whether existing identity and role processes can support that discipline. Accumulated rights after transfers, temporary projects and contractor accounts will transfer directly to agents unless cleaned up. Buyers should ask vendors how agent permissions inherit user roles, how access is reviewed and revoked, and how granular the controls are by tool, data source and action. This news alone does not prove lower breach rates, and the IBM range describes breaches broadly rather than monday. com deployments specifically.
The marker to watch is how monday. com operationalizes least privilege in its native agents over the next release cycles. Concrete signals include default minimum-access templates, staged enablement options and audit views of agent actions by permission. If such controls appear as standard product behavior rather than custom setup, controlled deployment may become the normal path to scale. That would make permission hygiene a measurable factor in AI return.
