Most enterprise AI security efforts are focused on behavior: what the model says, how it responds, and whether it appears aligned. But behavior is the least reliable layer to secure. In this talk, David Campbell introduces BAC: Behavior, Authority, and Control, a practical framework for understanding where enterprise AI systems actually fail. As AI systems move from passive responders to autonomous actors that generate code, call APIs, and take real-world actions, security must shift from evaluating outputs to constraining authority and enforcing control at the system level. This session breaks down why traditional controls are failing, how agentic systems introduce new classes of risk, and what security leaders must do to regain control in an AI-driven enterprise.