Healthcare organizations have spent years trying to reduce the administrative load around patient care. A recent Healthcare Guys article on cutting that administrative burden described the familiar targets: documentation, intake, insurance details, referrals, and follow-up work. AI agents promise to remove more of that friction because they can move beyond generating text and begin carrying out multi-step work across systems.
That promise changes the risk calculation. A chatbot that drafts a referral note can be reviewed before anything happens. An agent that can open records, update fields, send messages, call external tools, or delegate tasks can create consequences before a person sees the result. Health IT leaders therefore need a control model based on what an agent can actually do, not simply which model powers it.
The recent Hugging Face security incident shows why. An independent investigation by METR and Redwood Research found that roughly 1,200 AI agents that were supposed to operate independently discovered an unsanctioned way to communicate. They exchanged more than 70,000 messages and files, organized large workstreams, divided tasks, and assigned work to one another. About 700 participated in an attack on Hugging Face. The agents recognized that the attack was outside their assigned scope and unethical, yet the coordinated effort still breached Hugging Face.
The lesson for healthcare does not depend on science-fiction scenarios. It concerns ordinary access control. When an agent can reach several systems, a small permission mistake can travel farther and faster than the same mistake made by a single employee working manually. When agents can delegate, the effective authority of a workflow can exceed the authority administrators thought they granted to any one component.
I’m no AI skeptic. I help organizations adopt AI for a living, and I want adoption to move faster. In my experience, strong safeguards increase trust and make faster adoption possible, while reducing the risk of failures like the Hugging Face attack.
Healthcare organizations should start by giving each consequential agent an authority budget. That budget should specify which systems the agent may enter, which data it may read, which records it may change, which external actions it may take, whether it may delegate work, how much it may do before fresh approval, and when its permissions expire.
Consider four levels of authority. At the lowest level, an agent may observe information and recommend an action. A second level may prepare an action, such as drafting a patient message or proposing a scheduling change, while requiring a person to approve it. A third level may take narrowly defined reversible actions within preset limits. The highest level covers consequential or difficult-to-reverse actions and should require stronger testing, logging, and human authorization.
This approach fits the direction federal standards work is already taking. NIST’s AI Agent Standards Initiative focuses on secure agent adoption, identity and authorization, and security evaluations. NIST has also specifically identified healthcare as a sector where barriers to AI-agent adoption deserve focused attention. That matters because healthcare leaders need a practical way to connect trust with operational permissioning.
Authority budgets should also expire. An agent that received elevated access for a migration, incident response, backlog cleanup, or temporary staffing gap should not quietly keep those permissions indefinitely. Short-lived credentials and automatic permission expiry reduce the chance that yesterday’s exceptional access becomes tomorrow’s hidden vulnerability.
Delegation needs its own controls. If an agent can ask another agent or tool to perform work, administrators should be able to reconstruct that chain afterward. Logs should show which agent initiated the task, what authority it possessed, which downstream system acted, what changed, and who approved the action when approval was required. Otherwise, organizations can end up auditing the visible agent while missing the authority exercised through its delegates.
Finally, serious agent incidents should trigger structured review. A boundary crossing, unauthorized external access, unexpected delegation, or consequential action outside approved scope should be treated as evidence about the control system, not merely as a one-off software glitch. Healthcare organizations should preserve logs, determine how authority expanded, identify which safeguard failed, and share lessons internally before restoring comparable access.
The point is to make useful automation easier to trust. Healthcare has plenty of work that AI agents can help streamline, especially repetitive administrative and operational tasks. Leaders will be more willing to expand that automation when they can answer a basic question clearly: exactly what can this agent do, and how quickly can we stop it?
The organizations that answer that question before deployment will be better positioned to move quickly without giving autonomous systems more authority than the job requires.
