Internal AI Agents: Fix the Permissions First

Internal AI agents, defined

Internal AI agents are agents that employees use and that run only on a company’s own systems. They read the data warehouse, the intranet, the ticket queue and the document stores, and they never face a customer. Most large companies are scaling this kind first, because it looks like the safe end of agentic AI. It is also where the oldest mistakes in enterprise IT come back to bite.

New here? I publish one agentic AI governance post every weekday. Subscribe to the blog and it lands in your inbox the moment it goes live.

You cannot clean up permissions after the agent ships. You can clean them up before.

Adoption is real, the return is not yet

McKinsey’s August 2026 survey found 40 percent of firms over $1 billion in revenue now scale agents, up from 27 percent a year earlier. Smaller firms, meanwhile, sat flat at 22 percent. The functions that scaled first were IT, knowledge management and software engineering. All three run internal AI agents, not customer-facing ones.

The money story is less cheerful. The same survey put the share of companies reporting any profit impact from AI at 37 percent, unchanged from 2025. Gartner went further in June 2025. It predicted that more than 40 percent of agentic AI projects will fold by the end of 2027, and its analyst called most of them hype-driven experiments. So the adoption is real, but the proof of value is still thin.

The most honest number I found came from a UK government department. It ran a controlled trial of 1,000 copilot licences and found no evidence that the time saved improved productivity. Satisfaction was high, but spreadsheet work got slower. And 22 percent of users saw the tool make things up. Keep that trial in mind while reading the vendor numbers below.

Three banks built a fence before they built agents

A large US custody bank put one internal agent platform in front of its whole workforce. Today about half of its 46,500 employees build their own agents on it. Its “digital employees” validate payment instructions. Each one gets its own login and access controls, the same way a new hire would. The bank has not published a dollar outcome, which I respect more than a round number.

A US universal bank took a similar path. It gives roughly 250,000 staff one internal portal to several models and keeps the data inside its own walls. About half the staff use it daily. A US wealth manager went narrower still. It put an assistant over 100,000 internal research documents and ran a formal evaluation suite before any adviser touched it. Adoption reached 98 percent of adviser teams, and the evals are the reason, not the model.

The common thread for internal AI agents is a gateway between the employee and the model. Each request passes through role-based access, logging and a kill switch, so employees build inside the fence. Nobody hands out raw chatbots.

Narrow agents over curated data outperform clever ones

A US ride-hailing company built a natural-language-to-SQL agent over its warehouse, and query authoring then fell from about ten minutes to three. But the interesting part is what failed first. Plain similarity search over the whole schema did not work. So the team added workspaces that limit each question to one domain, then agents that pick the tables and prune the columns before any SQL gets written. Narrow beat clever.

The same thing happened at a Brazilian bank with its open-finance analysts. A governed text-to-SQL agent turned data requests that took hours or weeks into seconds, and the analysts can read the SQL it wrote. Over in Denmark, a pharma company pointed an agent at internal trial data. It cut clinical study report drafting from more than ten weeks to ten minutes, with humans still reviewing every regulated page. Each of these internal AI agents comes with a vendor-reported number. Still, the shape repeats: one domain, curated data, a human on the output.

The permissions were fixed before the agent arrived

A $1.7 trillion sovereign wealth fund connected Claude to its cloud warehouse over MCP and reports 20 percent of a working week saved. Then a data-security vendor connected one agent to 40 internal tools, but only after it had re-scoped its own warehouse permissions and mapped who could reach what. One Canadian telecom let employees build 13,000 custom tools on a platform with central access control over every model and data source, and claims 500,000 hours saved.

The ordering is the whole point. In each case somebody reviewed the access lists before the first connection, not after the first incident. In my work in regulated loan origination, I will not connect an agent to a system nobody has access-reviewed this year.

Internal AI agents fail at the boundary, not in the model

The clearest failure is permission inheritance. The dominant office copilot shows a user only what that user can already open, which is a security feature. But it also means ten years of over-shared intranet sites become searchable in plain English overnight. A Gartner poll, reported in secondary coverage, found 40 percent of IT leaders delayed rollout by three months or more for that reason. The agent did not leak anything. It just read what it could read.

What I do before connecting an internal agent

Four things, in order:

I run an oversharing audit on every store the agent will read
I fix the access lists before the first connection. Every production agent then gets its own identity, an owner and the smallest scope that still does the job.
I treat every document and email the agent ingests as untrusted. So an agent that reads outside content never also holds the keys to sensitive data or outbound links.
And every third-party connector gets vetted the way I would vet a SaaS vendor, with isolation, logging and a way to pull the plug.

Then I measure like that UK department did, with a control group and an output score, because self-reported hours saved flatters everyone. On my Five-Stage Roadmap, an internal agent that reads a clean, scoped store under its own identity sits at Governed. One that writes back to a system of record without a human gate does not, however good the demo looked.

Internal AI agents are the easiest agents to justify and the easiest to get quietly wrong. Instructions in, results out was IT; intent in, outcomes out is agentic AI. But the outcome still depends on what the agent could reach, and somebody decided that long before anyone wrote a prompt.

Which internal store in your company would you least want an agent reading in plain English tomorrow?

Was this post useful? One click tells me what to write next.

← Back

Thank you for your response. ✨

Go deeper

Agentic AI Architect: control design for enterprise agents.
Agentic AI Case Studies: deployment evidence, one teardown at a time.
Agentic AI P&L: cost, payback, and risk in a CFO’s voice.
Agentic AI SDLC: the lifecycle that builds the agents.
Subscribe to the Blog: I publish a new post every weekday on one agentic AI governance question. Enter your email and each post arrives in your inbox the moment it goes live.

Dr. Harish Kotadia, Ph.D., is an Enterprise AI Architect with 20+ years of IT consulting experience serving Fortune 100 clients, specializing in agentic AI systems built on Anthropic Claude, AWS Bedrock, and Google Vertex AI.

Disclaimer: This blog post is based on publicly available academic publications, vendor documentation, open standards, and news items from reputed media sources linked above. This post is intended for educational purposes, to help the enterprise agentic AI community build a shared vocabulary from public, authoritative sources.

Views and opinions expressed here are my own and do not represent those of any employer or client, past or present. The analysis presented is my independent interpretation of the published sources linked above and does not constitute legal, financial, or consulting advice of any kind.