PwC documents a case in which a global technology company ran autonomous agents across four enterprise platforms: Salesforce qualifying leads and generating quotes, Oracle posting revenue recognition, Workday adjusting commissions and onboarding hires, SAP procuring fulfilment services. Each agent operated inside its own platform, and each platform's security team reviewed and approved its permissions. Every access review passed. For nine months, no issue was flagged.
What the Company's Own Audit Found
According to PwC's account, the pattern was found by the company's own internal audit function, well after every platform-level control had already signed off on the activity that produced it. As deals closed in Salesforce, the same transaction moved automatically through the other three systems: revenue was recognised in Oracle before the related third-party fulfilment costs were fully visible, those costs were then procured through SAP, and commission tiers were updated in Workday against the original deal value rather than the margin that remained after fulfilment. In 87 cases, the commission paid exceeded the margin the deal actually produced. The company paid its own sales organisation more than the deal was worth.
No alert fired, and no exception report caught it. The pattern surfaced only through a manual margin review that happened to examine the relevant data across systems — nine months after the first instance.
Why Segregation of Duties Didn't Catch It
Segregation-of-duty controls exist to stop the party requesting an action and the party approving it from being the same. In this case, no single agent did both: commission calculation happened in Workday, revenue recognition in Oracle, procurement in SAP — entirely separate systems, entirely separate approval chains. That is exactly what a segregation-of-duty review is designed to confirm, and every review confirmed it. The conflict lived in the sequence connecting the four systems — deal closure, revenue posting, procurement commitment, commission adjustment — a chain none of the platform-level controls extended far enough to observe.
Composed Permissions Look Individually Reasonable
Kovrr's analysis of multi-agent systems names the mechanism directly: agents each holding modest, individually reasonable permissions can compose an action none of them was authorised to take, and no single permission grant looks wrong in a review. An agent authorised to draft a payment instruction, one authorised to validate it, and one authorised to submit it can together constitute an authority nobody granted. Each of the three permissions passes review on its own terms. Segregation of duty assumes the requester and the approver are different parties, and a chain of agents can satisfy that requirement on paper while still routing the outcome through each other.
The controls didn't fail. They weren't built for this.
— PwC, "Where Agentic AI Breaks Enterprise Controls," 2026
Where Governance Needs to Move
The Permission Boundary layer in the AI Agent Governance Stack is the part most organisations have already built, because it maps onto identity and access management they already practise. This case shows a correctly built Permission Boundary layer operating at capacity: every platform enforced least privilege, and every agent operated inside its authorised scope. The gap sat one layer up, in the orchestration connecting the platforms — a layer that sits outside every platform's access review by design.
Kovrr's proposed fix operates on identity rather than scope: an agent identity permitted to propose an action sits in a different trust tier from one permitted to execute it, and no delegation path is allowed to cross that boundary. Applied to this case, the agent adjusting commission eligibility in Workday would sit in a different trust tier from the one recognising revenue in Oracle, with the full chain evaluated before commission is paid, rather than each platform's slice of it evaluated after the fact.
Each of the four platforms in this case performed exactly as designed. The failure sits in the orchestration layer connecting them — the space a segregation-of-duty review reaches only when it looks across systems, not within one.