A customer visits a retailer’s website to compare two jackets. An AI agent might do the same thing on the customer’s behalf, checking sizes, prices and delivery dates across several stores. The retailer has a reason to welcome that visit. But the same agent might later try to sign in, change an address or complete a purchase. Each step carries a different level of risk.
That is the challenge facing businesses as AI agents begin to use their websites and applications. The familiar choice between allowing automated traffic and blocking it is too blunt. An agent can be useful to the business in some sessions and require closer scrutiny in others.
Knowing Who the Agent Is Only Gets You So Far
Identity is a sensible starting point. If an agent presents verifiable credentials, a business has more information than it would have from an unknown bot. But verification does not tell the business what the agent intends to do, whether it has the customer’s permission for a particular action or whether its behavior will stay within its stated purpose.
Consider an agent that says it is gathering product information. Browsing product pages fits that purpose. Repeated attempts to reach account settings or checkout pages deserve a different response. The agent’s identity may be exactly what it claims. Its actions still need to be evaluated.
This distinction matters beyond retail. A travel agent may only declare the need to access flight availability but eventually may also encounter loyalty accounts and payment details. A financial services agent may start by retrieving general information before attempting to interact with an application that handles sensitive data. The risk changes as the task changes.
Businesses need enough visibility to follow that progression. Radware’s H1 2026 Global Threat Analysis Report found that 77% of organizations are deploying or implementing AI agents, while only 17.2% reported full visibility into the agents operating in their environments. That gap makes it harder to determine what agents are doing and when their activity warrants intervention.
Trust Has to Be Reassessed During the Visit
A decision made at the start of a session cannot cover every action that follows. An agent may declare a legitimate purpose and then move into a workflow that calls for different permissions. It may encounter instructions in external content that redirect its behavior. It may also make a mistake while carrying out an otherwise authorized task.
Security teams should be able to compare what an agent declares it is trying to accomplish with what it actually does. That means continuously and constantly looking at requests, navigation path and attempts to enter sensitive workflows as the session unfolds. If the behavior changes, access should change with it. An agent might still be allowed to browse while more sensitive actions, such as login or checkout, require additional scrutiny.
The goal is to give agents useful access with clear boundaries. A retailer that blocks every agent could make its products harder to discover through emerging shopping tools. A retailer that treats every recognized agent as fully trusted could expose customer accounts and transactions. Permissions tied to specific actions give the business more room to make a sensible decision.
Build Rules Around the Task
Organizations can start by identifying which agent activities they want to support. Reading public product information, checking inventory, accessing an account and making a purchase should not all carry the same permission. Teams can then define what evidence they need before allowing each action and what activity would cause them to reassess access.
They also need a record of what happened. When an agent attempts an unexpected action, investigators should be able to see what it claimed it was doing, where it went and which controls responded. That record helps teams investigate incidents and refine their rules as agent behavior changes. It also helps them showcase compliance with global regulation standards.
Agent traffic will become more varied as businesses find new ways to let software act for customers. Some interactions will be valuable. Others will be careless or harmful, even when the agent’s identity is known. Businesses that can evaluate each agent’s actions throughout a session will be better placed to welcome the useful activity while protecting the accounts, transactions and data behind their applications.
_______
About Dror Zelber
Dror Zelber is vice president of product at Radware and has 30 years of experience in the technology industry. Throughout his career, he has worked across cybersecurity, networking and mobility, managing both technical and business relationships with partners around the world. His background includes inbound and outbound product management, giving him experience across product development, market strategy and customer needs.
At Radware, Dror focuses on emerging security challenges involving applications, networks and AI systems. He has written and spoken extensively about DDoS protection, application delivery, large language model security and the risks organizations face as autonomous AI agents gain access to sensitive data, applications and business tools.
Join our LinkedIn group Information Security Community!
