Agent governance fails when controls are sequenced out of order

At a glance

What this is: NHI Mgmt Group's analysis, drawing on AppViewX's event briefing: Agent governance stalls when inventory, purpose, authority measurement and runtime enforcement are handled in the wrong order.

Why it matters: IAM and security teams need sequencing discipline because governance controls for agents depend on identity, purpose and runtime evidence being established before review and enforcement can work.

By the numbers:

• Roughly 20 teams and close to 100 people took 20 real business problems and tried to solve them with AI.

Context

Agent governance is not a single control problem. It is a sequencing problem in which inventory, ownership, purpose, authority and runtime enforcement all depend on earlier facts being established before later decisions can be trusted.

That matters because a register with no maintainer, an ownerless agent, or an authority profile that has not been measured produces governance artefacts without durable control. In practice, the operating model has to be built from the lifecycle outward, not imposed as a policy layer after adoption has already spread.

Key questions

Q: How should security teams govern AI agent access alongside human identities?

A: Security teams should govern AI agent access with the same identity controls used for people, then add agent-specific guardrails. Assign each agent a unique identity, scoped permissions, and short-lived credentials. Enforce JIT access, ZSP, PAM, RBAC or ABAC, and strong authentication for sensitive actions. Centralize logging, session recording, approval workflows, and continuous review so agent privileges stay tied to business purpose and can be revoked quickly.

Q: How should teams measure privilege risk across multiple systems?

A: Measure privilege risk by aggregating each system’s granted permissions, sensitive data reach, and ability to invoke tools or make changes, then map that across all agent identities and human owners. A practical view combines entitlement breadth, standing privileges, credential exposure, and the number of systems each account can affect. That shows where a single compromised token, service account, or agent could cause cross-system impact.

Q: Why does runtime enforcement matter more than access review for agents?

A: Runtime enforcement matters more because agents can change behaviour between reviews, so policy must control each decision and tool call, not just snapshot permissions. Access review only confirms what was approved at a point in time. Runtime controls such as scoped tokens, policy checks, approvals for high-consequence actions, and revocation stop an agent from using valid access in unsafe ways.

Q: What should teams do first when agent governance is still immature?

A: Start with a maintained inventory with ownership and purpose, listing every agent, its human accountable owner, the credentials it uses, and the systems it can reach. That inventory gives a baseline for revocation, scope reduction, and approval workflows. Without it, governance cannot reliably track where authority exists, who can change it, or which agents still need access.

Technical breakdown

Why agent inventory fails when it is treated as a report

An inventory only works when it is maintained as an operational system of record, not a snapshot. For AI agents, that means a named owner, a refresh expectation, and a decommissioning path that revokes credentials rather than simply deleting a row. Without those lifecycle hooks, the register degrades quietly while still looking complete on the dashboard. The real failure is not discovery. It is the absence of an accountability model that keeps the inventory current as agents multiply across SaaS, internal applications and endpoints. See the Agentic AI Identity Guide.

Practical implication: Treat the agent register as a governed asset with ownership, refresh cadence and offboarding, not as a one-time discovery exercise.

How composite authority changes agent privilege

Agent access cannot be judged system by system in isolation when one agent accumulates modest privileges across several systems. Composite authority is the effective total capability created by multiple grants, credentials and downstream integrations working together. That total can exceed what any individual approval seemed to allow, which is why segregation of duties matters for agents as well as people. The architectural issue is that the privilege risk only appears in aggregate, after separate entitlements are combined into one operational path.

Practical implication: Measure total authority across systems before tightening individual permissions, and prioritise combinations that create segregation-of-duties conflicts.

Why runtime enforcement beats review for agent actions

Access review tells you what an agent was allowed to hold at a point in time. Runtime enforcement tells you whether the agent should be allowed to act at the moment it acts, which is a different control question. This distinction matters most for high-consequence actions such as terminal access, infrastructure changes and writes to systems of record. Standing privilege is the exposure multiplier because continuous authority exists for as long as the grant remains active, while task-scoped authority reduces the window of misuse to the task itself. See the AI Agent Authorisation Guide.

Practical implication: Apply policy before execution for the least reversible actions and remove standing privileges from the highest-authority agents first.

NHI Mgmt Group analysis

Sequence is the control plane for agent governance. The controls themselves are not the problem, because teams usually agree on the end state. The failure is that each control depends on the output of the previous one, so putting enforcement before ownership or tuning before authority measurement produces governance theatre. The practitioner conclusion is that sequencing is a security control in its own right, not a delivery preference.

Declared purpose is the governance hinge for agent identity. An agent with no stated purpose can justify almost any access because every request is technically possible. Once purpose is written down, access becomes reviewable against intent rather than capability. That shift matters across agent identity programmes because it turns a free-running process into an accountable enterprise asset, which is the difference between expansion and governable scale.

Composite authority is the named risk that most programmes miss. A single agent can look harmless in each system and still become overpowered when its access is combined across models, servers, credentials and downstream tools. This is the point where segregation of duties must be evaluated on the full path, not on individual grants. The implication is that authority must be measured as a total before remediation is prioritised.

Standing privilege creates the longest exposure window in agent governance. Continuous authority leaves the agent exposed for the entire period it can act, while task-scoped access narrows that window to execution time. That makes runtime enforcement and revocation order critical, especially for the highest-authority agents and the least reversible actions. The practitioner conclusion is to retire persistent privilege first where rollback is hardest.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Purpose and ownership are now gating controls for agent scale. Once agents move from pilots into production, the question shifts from whether they exist to whether each one has a lifecycle, a purpose and an accountable owner. Programmes that skip those facts will keep generating access decisions that cannot be defended later.

Authority will have to be governed as a total, not an entitlement list. The operational model has to account for composite privilege across systems, because the risk emerges when separate grants combine into a capability that no reviewer approved in isolation. That is where least privilege becomes a measurement problem, not a policy statement.

Standing privilege is the first design assumption to collapse. Access reviews assume a privilege lasts long enough to be observed and certified. When agents acquire and release access around execution, the control has to move to issuance time, not review time.

For practitioners

• Build the agent register as a maintained system of record Assign a named owner to every agent, define a refresh cadence, and require a decommissioning path that revokes credentials when the agent is retired.
• Record a written purpose for every agent Make purpose mandatory at issuance so later access requests can be judged against intended function rather than raw technical capability.
• Measure composite authority before tuning permissions Review each agent’s combined access across models, servers, credentials and downstream systems, then rank privilege combinations that violate segregation of duties.
• Start runtime enforcement with irreversible actions Apply policy before execution for terminal access, infrastructure changes and writes to systems of record, then remove standing privilege from the highest-authority agents first.
• Generate audit evidence from live runtime data Use agent lifecycle workflows and signal sharing so reviews can rely on current privilege state instead of manually reconciled reports.

Key takeaways

• Agent governance fails when identity, purpose, authority and enforcement are sequenced without dependency awareness.
• Composite authority is the practical risk that emerges when separate grants across systems are treated as independent.
• Runtime controls matter because standing privilege and late-stage review cannot reliably constrain high-impact agent actions.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Maturity Model

Key terms

• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Composite Authority: Composite authority is a combined set of permissions or decision rights held by one actor, often built from multiple roles, policies, or delegated credentials. In identity and access management, it matters when an agent or user can only perform an action by joining several grants, which can obscure effective power and complicate review and revocation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.