AI moves from output to action — a new security challenge for Vaughan
As artificial intelligence shifts from experimentation into day‑to‑day enterprise workflows, security experts say organisations must rethink how they govern systems that can not only generate content but also take automated actions. That warning came from Dawn‑Marie Vaughan, DXC Technology's Cybersecurity Global Offering Lead, in a recent industry discussion about AI security and governance.
Vaughan companies — including local small and medium enterprises, managed‑service providers and public sector IT shops — that are starting to embed AI agents into operations will face a different threat landscape. Where traditional access controls focused on identity and authentication, agents introduce a second axis of risk: actions taken after authentication, often at machine speed and without continuous human review.
Vaughan organisations should therefore move beyond identity‑centric controls to policies that evaluate whether an agent should perform a particular operation in a particular context. That approach was described by Vaughan as transforming Zero Trust from an identity verification model into one that makes real‑time, decision‑level policy choices.
“The issue is not whether an agent can authenticate. The issue is whether it should be allowed to take a particular action, with particular data, through a particular tool, all at that precise moment.”
In the interview Vaughan explained that AI agents now do more than provide responses or draft documents. They can query sensitive systems, invoke external tools, coordinate multi‑step workflows and act autonomously — capabilities that render traditional human oversight insufficient on its own.
How DXC and Primary propose to close the gap
DXC and security partner Primary are developing what they call an "AI‑native Zero Trust" model. The core idea is to bring enforcement to the precise point where an AI agent translates access into action, subjecting every meaningful interaction — prompts, tool invocations, data exchanges and responses — to policy checks tied to business context.
- Decision‑level governance: Evaluate each agent action against contextual policies rather than relying solely on identity checks.
- Tool‑level control: Restrict which external tools and connectors an agent can invoke based on current risk and purpose.
- Policy enforcement at runtime: Make enforcement immediate and automated at the moment of action.
For Vaughan IT teams this means adopting controls that can assess the appropriateness of an agent’s action in real time, not just whether it has valid credentials. The partnership emphasises integration and enforcement across existing security stacks rather than adding isolated consoles.
Practical implications for local organisations
Local businesses and public services adopting AI must consider three practical areas:
| Area | Consideration |
|---|---|
| Access vs action | Ensure policies evaluate the intent and context of agent actions, not only identity and permissions. |
| Tooling and integrations | Control which agent‑facing tools are available and limit high‑risk connectors (for example, systems with financial or personal data). |
| Audit and accountability | Capture decision logs that show why an action was allowed or denied to support incident response and compliance. |
These measures matter for organisations that manage personal information, financial transactions or operational technology. In Vaughan, where a mix of retail, manufacturing and professional services coexist alongside municipal services, failing to adapt governance could expose organisations to data leakage, unauthorised transactions or operational disruptions driven by AI‑enabled automation.
Vaughan organisations contemplating AI deployments should inventory where agents will touch sensitive systems, identify high‑risk actions, and adopt runtime policy enforcement that ties decisions to business context. Vendors and integrators are positioning products and partnerships to help with that, but successful implementation still requires local IT leadership to define what counts as an acceptable action in their operational environment.
As AI adoption accelerates, the message from DXC is straightforward: identity checks remain necessary but are not sufficient. Decision‑level controls — evaluating each attempted action, by each agent, in its precise context — will be essential to enable safe, scalable AI in Vaughan's businesses and public services.
Local IT teams and leaders should expect vendors to present new tooling and integration approaches in the coming months, and to test those capabilities against the specific operational risks their organisations face.
