Generative AI introduces new control points that standard cloud controls do not fully understand, especially model inference, prompt handling, and agent cognition. These workflows can leak data or behave in unintended ways without looking like classic infrastructure compromise. Organisations need AI specific visibility, policy enforcement, and audit trails to govern what the system can see and do.
Why This Matters for Security Teams
Generative AI deployments create governance gaps because the most important actions happen above the cloud control plane. Traditional tools are strong at monitoring infrastructure, identities, and network paths, but they do not reliably understand prompts, model outputs, retrieval sources, or agent decisions. That means a system can leak sensitive data, call tools, or alter workflows without looking like a conventional compromise. NIST’s NIST AI 600-1 Generative AI Profile treats these as distinct risk surfaces, and NHIMG’s Top 10 NHI Issues shows why identity and lifecycle controls must extend beyond humans and servers.
The practical issue is that cloud security often assumes static assets with predictable permissions, while GenAI systems can change context at runtime and trigger downstream actions that were never explicitly approved. The 2026 Infrastructure Identity Survey found that 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems. In practice, many security teams discover these gaps only after an AI workflow has already accessed data, invoked tools, or moved further than the original design intended, rather than through intentional governance.
How It Works in Practice
Closing the gap requires treating the model, the prompt path, and any connected agent as governed runtime components, not just hosted software. Current guidance suggests layering AI-specific policy enforcement on top of cloud controls so security decisions can be made at request time, with context about who initiated the task, what the model is allowed to see, which tools are in scope, and whether the action is still within policy. This is where NIST Cybersecurity Framework 2.0 and the CSA Cloud Controls Matrix help as control anchors, but they need to be extended for GenAI telemetry and authorization.
Practitioners usually need four mechanics working together:
-
Prompt and output logging so security teams can reconstruct what the model received and returned.
-
Runtime authorization for tool calls, retrieval, and data access, rather than assuming inherited cloud permissions are enough.
-
Data boundary controls that redact, filter, or constrain sensitive content before it reaches the model.
-
Audit trails that connect user intent, model activity, and downstream system changes.
NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because GenAI deployments increasingly rely on non-human credentials, service accounts, and ephemeral access paths that need lifecycle discipline. The same pattern appears in breach analysis such as the Snowflake breach, where identity and access posture mattered as much as infrastructure posture. These controls tend to break down when an AI system is allowed to chain multiple tools across separate cloud services because the combined action path no longer resembles any single approved workflow.
Common Variations and Edge Cases
Tighter AI governance often increases operational overhead, so organisations must balance visibility against latency, developer friction, and workflow complexity. Best practice is evolving, and there is no universal standard for how much prompt content, model reasoning, or retrieval context must be retained, especially where privacy or regulated data is involved. The right answer depends on risk appetite, data sensitivity, and whether the system is assistive or fully autonomous.
Edge cases matter. A chat assistant used for internal drafting is governed differently from an agent that can open tickets, change infrastructure, or query production data. In highly distributed environments, cloud-native logging may capture the container and API layer but still miss the decision boundary inside the model runtime. NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives is the better lens when auditors ask who approved access, how long it lasted, and whether the system could prove least privilege in practice. The key distinction is that GenAI governance is not just about securing a workload, but about constraining unpredictable behaviour at the moment of action.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Agentic apps create runtime decision risks that cloud tools do not see. |
| CSA MAESTRO | MAESTRO-1 | Maps to securing agent workflows, orchestration, and tool use. |
| NIST AI RMF | AI RMF addresses governance gaps in GenAI risk, accountability, and monitoring. | |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access still matters, but must extend to AI runtime actions. |
| OWASP Non-Human Identity Top 10 | NHI-03 | GenAI deployments often rely on secrets and service identities that must rotate. |
Assign owners, monitor model behavior, and document controls across the AI lifecycle.
Related resources from NHI Mgmt Group
- Why do AI agents create security blind spots that traditional cloud and container tools miss?
- Why do GenAI tools create governance gaps that traditional network security controls often miss?
- Why do AI workloads create gaps in traditional cloud security models?
- Why do AI and LLM applications create security risks that traditional tools often miss?
