Who should own governance when AI and agentic systems are used in deception operations?

Ownership should sit with security leadership, but governance must span SOC operations, identity teams, and risk owners. AI and agentic systems can automate deception actions, yet they still need policy guardrails, control boundaries, and reviewable outcomes. Clear accountability is essential when synthetic identities or autonomous responses influence live attacker interactions.

Why This Matters for Security Teams

Deception operations change the ownership question because the system is not just collecting telemetry; it is actively shaping attacker interaction, deciding when to reveal, redirect, or delay, and sometimes triggering automated countermeasures. That puts the activity squarely in security leadership’s remit, but it also crosses into SOC execution, identity governance, and risk acceptance. Current guidance suggests treating deception as a controlled security capability, not an experiment hidden inside AI tooling.

The practical risk is that synthetic identities, decoy assets, and autonomous responses can influence real attacker decisions while still depending on privileged access, secrets, and logging discipline. NHI failures in adjacent AI workflows show how quickly access abuse becomes operational, as reflected in NHIMG research on LLMjacking: How Attackers Hijack AI Using Compromised NHIs and AI Agents: The New Attack Surface report. Security leaders need to own the control plane, because the moment deception systems act without reviewable boundaries, the organisation has created an autonomous response path with attacker-visible consequences.

Industry consensus is still forming, but the direction is clear in the OWASP Top 10 for Agentic Applications 2026 and the NIST AI Risk Management Framework: accountable ownership must cover design, deployment, monitoring, and rollback. In practice, many security teams encounter ownership gaps only after a deception response has already touched production systems or exposed an identity control weakness.

How It Works in Practice

Ownership works best as a three-layer model. Security leadership owns policy, approval thresholds, and escalation criteria. SOC operations owns day-to-day tuning, response orchestration, and live oversight of agent actions. Identity and platform teams own the credentials, service identities, and access boundaries that let deception agents operate safely. That split matters because an AI-driven deception workflow can behave like a workload, a sensor, and an operator at the same time.

In practice, the strongest programs use workload identity, short-lived secrets, and policy-as-code so the deception system can only do what the current task requires. This is where current guidance increasingly aligns with CSA MAESTRO agentic AI threat modeling framework and the MITRE ATLAS adversarial AI threat matrix: model the attack path, the prompt path, and the identity path together. For deception, that means per-task credentials, explicit approval for actions that touch external systems, and immutable logging of what the agent observed, decided, and executed.

NHIMG research on OWASP NHI Top 10 reinforces a key operational point: the same controls that protect AI agents from misuse also protect deception environments from becoming a new privilege corridor. Governance should require named business ownership for each deception objective, a documented kill switch, and reviewable outcomes for every autonomous response. These controls tend to break down in high-volume SOC environments where analysts bypass approval gates to reduce alert fatigue and the system starts taking attacker-facing actions without durable oversight.

Common Variations and Edge Cases

Tighter governance often increases response latency, so organisations must balance operational speed against the risk of an unmanaged autonomous action. That tradeoff is real in active defence, where analysts may want deception agents to react instantly while risk owners want every response pre-approved. There is no universal standard for this yet, but best practice is evolving toward tiered authority: low-risk baiting can be automated, while high-impact responses require human sign-off.

Edge cases usually appear when deception systems are embedded in broader AI operations. If the same agent can triage alerts, query threat intelligence, and interact with external services, ownership cannot sit only with the SOC. It must include identity governance for secrets, legal or privacy review when synthetic identities are used, and risk management when the output could influence live adversary behaviour. The NIST Cybersecurity Framework 2.0 and the Ultimate Guide to NHIs — 2025 Outlook and Predictions both support this shared-accountability approach, even though neither is specific to deception.

The hardest cases are multi-agent or cross-tool chains, especially when one agent creates the lure, another monitors attacker interaction, and a third triggers containment. Those designs need explicit control boundaries, because the governance model fails if no single owner can answer for the full chain of action.

Related resources from NHI Mgmt Group

• How should organisations operationalise AI governance for agentic systems and generative AI in regulated environments?
• What makes agentic AI an NHI governance issue?
• How should IT leaders prepare for agentic AI governance before autonomous infrastructure use becomes routine?
• Why does authorization become harder as agentic AI and autonomous systems take on more access decisions?