Australia’s AI oversight gap raises a question for every department

Cybersecurity is an awkward place to discover that AI has more authority than people can fully inspect. It is also a reason to look beyond the security team.

Australian coverage of Illumio’s research, published on 4 November, reports that 80% of Australian respondents’ organisations let AI make decisions and take actions that needed human approval a year earlier. Only 55% said they could see and audit every AI-agent action. ³

Sapio Research surveyed 1,100 IT and security decision-makers for Illumio, including 100 in Australia. The global research was released on 21 October. These are respondents’ accounts, not an independent inspection of Australian businesses. ^{1, 2}

The findings do not establish that every autonomous action lacks controls. Nor do they prove that sales, finance or administration are less well governed. They raise a useful management question: where else has a convenient assistant quietly acquired permission to act?

Consider a customer-service workflow. Drafting a response leaves a person to decide whether to send it. Sending that response, updating the customer record and offering compensation introduce separate decisions. A task described as routine can acquire commercial consequences as those permissions accumulate.

The point at which an assistant becomes an operator deserves an explicit decision. Ask the process owner to identify what it can read, change, send or commit, which actions need approval, and who can reconstruct what happened afterwards.

Start with one workflow your organisation regards as easy or low risk. Follow the permissions through its connected systems. Could it disclose confidential information, change a customer’s status or create a promise another team must honour?

Faster execution can be valuable. The useful boundary is between authority deliberately delegated and authority nobody realised they had granted.