When AI becomes ‘Sally from accounts’: The new identity risk facing businesses

Artificial intelligence is moving beyond the chatbot. Increasingly autonomous AI agents can be designed to carry out tasks, interact with business systems and act on behalf of users. The next step may be more human still: organisations experimenting with AI agents presented as named and personable digital co-workers.

The idea might be described as “character-as-a-service”. Rather than interacting with an anonymous software agent, an employee might deal with “Sally from accounts” or another persistent AI persona possessing a name, role and perhaps an avatar.

There are obvious usability advantages. Humanising software can make interacting with complicated technology feel more conversational and intuitive. Yet there is an accompanying cybersecurity problem. People do not necessarily separate perceived identity from actual authority.

This matters as organisations are already struggling with the identities attached to autonomous systems. Research reported by Digital Journal in August found that, among 306 security leaders surveyed by Okta, 47 percent said they could identify all the AI agents within their environments, while 45 percent said they could authorise what agents were allowed to do.  A friendly AI personality could add a distinctly human vulnerability to this technical governance problem.

Trust is not authentication

To explore the implications, Digital Journal reviewed some research performed by Alan Radford, Privileged Access Management Strategist at One Identity.

“The line between human and machines is beginning to blur, at least from a communication or ‘getting things done’ standpoint,” Radford explains.

For relatively straightforward activities, attaching human characteristics to technology may lower the barrier to using it. “If we were to give an AI agent a name, job title, even a face, we’d probably find it easier to work with,” Radford says. “That’s quite useful if we’re using it to help us book a flight or find an invoice, in the same way it’s easier to give rudimentary assistants names like Alexa or Siri.”

The problem begins when presentation is confused with provenance. A believable persona may unconsciously acquire the credibility normally associated with a genuine colleague.

Radford illustrates this with a fictional worker: “If an agent starts introducing itself to unwitting employees as ‘Sally from accounts’, they start attaching expectations to it. Sally works for the company, so she must be entitled to ask for this information and have access to it.”

That leap is significant because conventional identity security asks questions such as who or what is requesting access, what permissions it possesses and whether those permissions remain appropriate. Social interaction can operate differently. Familiarity, helpfulness and apparent organisational status can become proxies for trust.

“A convincing character can gain an awful lot of authority before anyone checks whether it should have any at all,” Radford warns.

Social engineering with patience

This creates another possibility: AI-enabled social engineering that develops over time. Traditional phishing commonly creates pressure for the recipient to act. A persistent AI identity could potentially take another route by first establishing familiarity.

“Ten minutes into a relatively innocuous interaction, an agent like Sally might ask an employee to approve a login or install something,” says Radford. “That’s ten minutes of apparently helpful interaction to lull an employee into a false sense of security before they give up some information.”

The longer-term possibility is particularly significant. An artificial persona does not necessarily need to steal the identity of a real executive or colleague. “An attacker can play the long game here, building a character that keeps returning, gradually learning about someone and using that familiarity to extract sensitive information or influence decisions,” Radford says. “The character doesn’t have to impersonate a real person. It just has to become someone – or something – you trust.”

This develops the familiar social-engineering problem in a new direction. The security question becomes not simply whether someone can identify an imitation, but whether employees understand that an apparently legitimate digital colleague is a machine and that its requests still require appropriate verification.

The issue sits within a wider shift towards agentic AI. Digital Journal has previously examined how agents capable of browsing, accessing accounts, making decisions or executing transactions can expand the potential consequences of insecure automation.

Giving every agent an identity

For businesses, Radford argues that the critical issue sits beneath the personality layer: what is this supposed digital employee actually permitted to do? “If an agent is granted access to customer records, emails, or payment information, those permissions need to be explicitly granted by the business and controlled continuously,” he says. In other words, making an AI look like an employee should not mean inheriting an employee’s privileges.

“Giving a character the personality of a finance manager must not automatically give it the authority of one,” Radford adds. “Just like any employee, it needs its own identifiable account, access limited to its job, and a person who it’s ultimately accountable to.”

There is already evidence that governance has yet to catch up with agent deployment. The Okta research found 21 percent of surveyed organisations were governing AI-agent access using shared credentials or broadly permissioned service accounts. This is important because shared or excessively broad access can make it harder to establish precisely which identity is responsible for a particular action.   More broadly, the emergence of machine identities is enlarging the identity-security landscape. One 2026 report covered by Digital Journal found non-human identities considerably outnumbering human users in the Microsoft 365 environments it studied.

Character-based agents add an unusual twist. A machine identity may now possess both technical permissions and a socially persuasive persona. The resulting security model needs to keep these concepts separate. An AI agent can be personable without being privileged. A job title can describe its function without determining its access rights. A familiar name cannot substitute for authentication

It also makes transparency important. Employees should know when their conversational counterpart is software rather than a human colleague. “I hope it goes without saying that people should be clearly informed that they’re interacting with an AI, but even that isn’t enough of a safeguard,” Radford cautions.

For organisations, this points towards treating AI agents as distinct identities requiring explicit ownership, narrowly defined access and continuing governance, rather than simply viewing agents as features attached to existing applications.

This distinction could become increasingly important as organisations move from experimenting with generative AI towards giving autonomous systems greater responsibility. Recent research also indicates the governance challenge is broader than cybersecurity alone.

An October CPA Canada study reported by Digital Journal found a substantial gap between workplace AI use and the prevalence of formal AI policies, training and strategies among respondents.  The paradox is that the better these artificial characters become at feeling like colleagues, the more disciplined businesses may need to become about remembering that they are not.

As Radford concludes: “We can make these systems friendly and useful, but still need to check who operates them and what they’re authorized to do. If the history of fraud has taught us anything, it’s that a convincing personality is a very poor security credential.”