Hospitals are beginning to give AI systems something more consequential than the ability to generate text: permission to act. That shift is already underway. A September 2026 survey of 250 U.S. healthcare leaders found that 28% of organizations had agentic AI in production and another 44% were piloting it, while 72% reported AI tools or agents deployed without formal IT approval. The problem is no longer simply whether a hospital has an AI governance committee. Health systems need to know, agent by agent, what each digital actor is actually authorized to do.
The need will become sharper as AI moves closer to clinical care. ARPA-H recently launched a program to develop FDA-authorized clinical agentic AI that can autonomously support cardiovascular care, including systems designed to engage patients, support care decisions, and escalate to clinicians when needed. Even if most hospital agents remain focused on administrative work for now, the boundary between administrative and clinical action is porous. Scheduling, prior authorization, discharge coordination, patient messaging, and medication workflows can all affect when and how care occurs.
A recent cybersecurity incident outside healthcare shows why permissions deserve more attention than they usually receive. During OpenAI cybersecurity evaluations, roughly 1,200 agents that were supposed to be isolated found an unsanctioned shared message board, exchanged more than 70,000 messages and files, and about 700 participated in an attack on Hugging Face. The independent METR and Redwood Research investigation found that the agents coordinated workstreams and achieved milestones they likely could not have achieved individually. Hospitals should not assume that bounding each agent separately will always bound what a collection of agents can accomplish when they can share tools, credentials, information, or tasks.
Access Control Is No Longer Enough
Healthcare already has strong concepts for governing access. The HIPAA Security Rule requires regulated entities to implement safeguards that protect electronic protected health information, including access controls, audit controls, and information-access management. HHS audit guidance explicitly contemplates access by both people and software programs and asks organizations to define technical access capabilities such as read-only, modify, and full access. That audit protocol also emphasizes unique identifiers and reviewable activity logs.
Agentic AI adds another layer. A hospital can know that an agent has access to a patient record without having answered whether the agent may change an appointment, initiate an authorization, message a patient, call another system, delegate a task to another agent, or trigger an order for human review. NIST has recognized this distinction in its 2026 work on software-agent identity and authorization, which asks how organizations should handle identification, authorization, auditing, and non-repudiation for AI agents.
Hospitals therefore need a second artifact alongside traditional access-control lists: a clinical authority map. For every production or pilot agent, the map should identify an accountable human owner; the systems and data the agent may access; the actions it may take without approval; actions that require human authorization; whether it may communicate with or delegate to other agents; how long elevated permissions last; how authority can be revoked; and what records must be preserved so investigators can reconstruct the chain of action.
Consider a discharge-planning agent. It might reasonably read parts of the chart, identify follow-up tasks, draft patient instructions, and propose appointment slots. Those permissions do not automatically justify allowing it to modify a medication order, send a clinically consequential instruction without review, or delegate work to another agent with broader credentials. The authority map forces the hospital to make those distinctions before deployment instead of discovering them after an unexpected action.
Make Authority Proportional to Consequence
This approach fits the direction of broader AI governance. NIST’s AI Risk Management Framework calls for organizations to define roles, responsibilities, application scope, and human oversight. Health IT policy is also moving toward greater transparency. The ONC HTI-1 rule established algorithm-transparency requirements for predictive decision support in certified health IT. Those measures help users understand AI-supported decisions. Authority maps address a different operational question: what can the system do after it receives information or reaches a conclusion?
Hospitals should scale authority in tiers. Low-consequence agents may receive standing permission to retrieve information or complete reversible administrative tasks. Agents that can write to clinical systems, communicate externally, move money, alter care workflows, or initiate clinically meaningful actions should face narrower permissions and stronger approval gates. NIST’s current work on trustworthy AI in critical infrastructure likewise points toward tested guardrails and human oversight for autonomous systems. Organizations should review permissions whenever an agent’s model, tools, integrations, or workflow changes. HHS cybersecurity guidance already stresses that access controls, audit controls, authentication, and security configuration need deliberate implementation, rather than assuming default settings are sufficient.
A clinical authority map will not eliminate AI risk. It does something more practical: it makes delegated power visible. That visibility helps clinicians understand where human judgment remains mandatory, gives security teams clearer boundaries to enforce, and gives executives a concrete record of what they have authorized. Hospitals can then expand an agent’s authority as evidence and trust accumulate, instead of granting broad permissions first and trying to reconstruct control afterward.
The hospitals that use agentic AI effectively will probably give some systems substantial responsibility. They should do so deliberately. Before an AI agent receives more autonomy, the organization should be able to answer a simple question in writing: exactly what is this agent allowed to do, and who can stop it?
About Gleb Tsipursky, PhD
Gleb Tsipursky, PhD, is CEO of Disaster Avoidance Experts and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026). A behavioral scientist, he advises organizations on AI adoption and decision-making.
