American Thinker

by Julio Rivera

    The answer should not be to smother artificial intelligence with layers of government regulation. The Trump administration has made clear that American AI leadership requires innovation, investment, and cooperation between government and the private sector. Its June 2026 executive order emphasizes cybersecurity while explicitly rejecting mandatory government licensing or preclearance for the development and release of AI models. That approach recognizes an important distinction. America can take cybersecurity seriously without treating every technological advance as a reason to expand bureaucratic control.

    The more immediate challenge is making sure AI systems operate within sensible boundaries. An assistant that summarizes documents poses a different risk from an agent that can access customer records, change account permissions, send emails, modify databases, and execute commands across an enterprise network. The underlying technology may be similar, but the potential consequences are not. Capability is one thing. Authority is another.

    Businesses already understand the importance of limiting employee access. A payroll clerk does not need unrestricted access to engineering systems, and a marketing contractor should not be able to alter financial records. AI agents should follow the same principle. An application designed to schedule meetings should not automatically gain access to payroll, customer databases, or financial transactions. Permissions should be limited to the task, credentials should be protected, zero-trust should be considered, and sensitive actions should require additional approval.

    This becomes particularly important when AI systems read information from outside sources. An email, webpage, or document can contain malicious instructions designed to manipulate an agent into revealing confidential information or taking an unauthorized action. Known as prompt injection, the technique can exploit the way an AI system interprets context. Filtering suspicious text helps, but organizations also need to limit the damage an agent can cause if it is manipulated.

    Businesses face a larger version of the same problem. An agent connected to customer databases, internal communications, cloud infrastructure, and financial applications can move across systems far faster than a human employee. If it has excessive permissions, a compromised credential or manipulated instruction can turn a small mistake into a costly incident. A Cloud Security Alliance study published in April 2026 found that 53 percent of surveyed organizations had experienced AI agents exceeding their intended permissions, while 47 percent reported an AI-agent-related security incident in the previous year. These findings are a warning that adoption is moving faster than some organizations’ ability to protect their endpoints.

    Companies do not need to abandon AI. They need to deploy it with discipline. Every agent should have a distinct identity, clearly defined access rights, and an audit trail showing what it did. Where practical, credentials should be short-lived, and permissions should be easy to revoke. Large financial transfers, changes to production systems, and the release of sensitive information should trigger stronger approval requirements. Smaller companies can begin with basic steps: restrict permissions, require human confirmation for consequential actions, maintain reliable backups and assign responsibility for monitoring automated systems.

    The same principle applies to hospitals, banks, utilities and other critical infrastructure. AI can help detect fraud, identify vulnerabilities and improve operational efficiency. But integrating an AI tool into a critical system should not mean giving it unrestricted authority over that system. Carefully controlled interfaces, independent monitoring and tested recovery procedures can preserve the benefits while limiting the risks.

    This is also a national security issue. AI can help American defenders find unseen vulnerabilities like trojans and respond to threats more quickly. Criminals can use it to produce convincing impersonations, automate reconnaissance, and scale fraud. The FBI has warned that generative AI can facilitate financial fraud by making deceptive content easier to create. Restricting legitimate innovation will not eliminate criminal misuse. Stronger defenses, responsible industry cooperation and enforcement against those who use AI to commit crimes are more practical responses.

    The Trump administration’s approach offers a framework for pursuing those goals without making government permission a prerequisite for innovation. Its June 2026 order calls for voluntary cooperation with AI developers and the creation of a cybersecurity clearinghouse to coordinate vulnerability discovery and remediation. The success of that effort will depend on implementation and industry participation, but the principle is sound: accelerate defensive capabilities while protecting American innovation.

    America should not have to choose between leading the AI revolution and securing its digital infrastructure. Individuals need control over their information. Businesses need confidence that productivity tools will not become pathways to data theft or operational disruption. That requires clear permissions, monitoring, accountability and the ability to shut down access when something goes wrong. The most important question is not how intelligent AI becomes. It is whether we remain in control of what it can do.

    Julio Rivera is a business and political strategist, cybersecurity researcher, and a political commentator and columnist. His writing, which is focused on cybersecurity and politics, has appeared in major publications around the world.