XTechAI chief warns AI agents need tighter enterprise controls

Amadeo Pérez, CEO of XTechAI, says AI agents are shifting from answering questions to taking actions inside business systems, creating new security and governance risks. He argues companies need stricter permissions, human oversight and audit trails as AI becomes embedded in enterprise software and workflows.

Why it matters: - AI agents can do more than generate text. They can access tools, business software and data, which raises the risk of harmful actions if permissions are too broad. - The shift could improve productivity across enterprise workflows, but it also increases exposure in email, CRM platforms, databases, servers and other critical systems. - Companies that add AI without security controls could face operational, cybersecurity and compliance problems.

What happened: - Amadeo Pérez, founder and CEO of XTechAI, outlined his view on AI agents, enterprise risk, cybersecurity and regulation in comments distributed from Málaga, Spain, on October 6, 2026. - Pérez said the key issue is no longer only what AI can do, but what companies allow AI to do. - XTechAI works in artificial intelligence, automation, IT consulting and custom software development.

The details: - Traditional generative AI usually answers a request and leaves the next step to a person. - AI agents can take an objective, choose tools, consult information and execute a sequence of actions. - In a business workflow, an agent could review an inquiry, find a customer in a CRM, check prior interactions, draft a proposal and update an opportunity. - Pérez said the biggest change is that AI will start acting, not just answering better. - He said companies should apply least privilege, a cybersecurity principle that limits each AI agent to the permissions required for its task. - A system that reads information does not need permission to change it. - An agent that drafts email does not necessarily need permission to send it. - A CRM-focused agent may need access to specific records without delete rights. - Sensitive actions can stay under human approval. - Pérez said he is more concerned about an AI system with too many permissions inside a company than about a hypothetical conscious machine. - He expects companies to use different autonomy levels based on risk. - Low-risk tasks can be automated. - Higher-risk tasks can be prepared by AI but require human validation before execution. - Sensitive data, financial systems, permissions and major decisions should remain under stronger supervision. - Companies will need logs showing what each agent did, what information it accessed, what tools it used and who approved important actions. - Logging, traceability and recovery mechanisms become more important as AI gains operational access. - AI and cybersecurity are converging as agents connect to real systems. - A text-only system creates one set of risks, while a system that touches credentials, databases, APIs, servers and enterprise software creates another. - The same AI tools that help defenders identify vulnerabilities can also support phishing, malicious automation and fraudulent content at scale. - Pérez pointed to recent industry warnings, including former Anthropic researcher Jacob Coxon’s resignation in September 2026 after raising concerns about AI safety and control. - Pérez said warnings should be taken seriously without assuming the worst-case scenarios are inevitable. - He also said AI, automation and robotics could displace work while also creating new roles and changing existing ones. - Pérez cited a report from U.S. Sen. Bernie Sanders that warned nearly 100 million U.S. jobs could potentially be replaced over the coming decade. - He said the main issue is how workers and companies manage the transition. - Europe is building a risk-based AI regulatory framework through the EU AI Act. - Pérez supports different rules for different risk levels, rather than treating every AI use the same. - He said summarizing a document is not the same as making important decisions about people, handling highly sensitive information or interacting with critical infrastructure.

Between the lines: - Pérez is arguing for governance before scale, not after deployment. - His comments frame AI as an infrastructure issue, where security and process design matter as much as model performance. - The message also reflects a broader enterprise shift: AI value depends less on novelty and more on control, integration and accountability. - Europe’s risk-based approach appears to fit that view, but the policy challenge is to guard against harm without slowing adoption.

What's next: - Companies are likely to expand AI use in CRM systems, internal applications, mobile apps, analytics platforms and custom software. - XTechAI expects AI consulting to focus on practical productivity, analysis and automation use cases with security and human oversight built in. - Custom software development will increasingly combine traditional architecture, automation and AI to create systems that can work with more intelligent tools. - The competitive divide will shift toward organizations that pair AI with reliable data, strong security, well-designed processes and human oversight.

The bottom line: - The next phase of AI is not just smarter outputs. It is software that can act, and that makes permissions, oversight and auditability the central enterprise questions.