TL;DR: Agentic AI governance gaps are widening as 86% of organisations lack visibility into AI data flows and 96% of enterprises now say AI agents are a security risk, according to Kong’s cited sources. The governance model is already breaking because review-based controls cannot keep pace with agent-timed access, tool use, and data movement.
At a glance
What this is: Kong argues that agentic AI governance is moving from a supporting control to the primary security control, because visibility gaps and unmanaged data flows are already outpacing manual review models.
Why it matters: IAM, security, and platform teams need a governance model that can control agent access, data movement, and tool use in real time before shadow AI and audit exposure become structural.
By the numbers:
- 86% of organisations have no visibility into their AI data flows.
- 96% of enterprises acknowledge that AI agents are a security risk.
- 20% of security breaches are now classified as shadow AI incidents.
Context
Agentic AI governance is the discipline of controlling how AI agents access data, invoke tools, and move information across systems. In this article, the core problem is not model quality but governance failure: organisations are deploying agents faster than they can map, authorise, or audit the resulting data paths.
That gap matters because shadow AI changes the identity problem. A traditional unsanctioned app stores data, but an unsanctioned agent reasons over it, combines it with other sources, and can propagate it through agent-to-agent and agent-to-API flows that static review processes never see.
Key questions
Q: What breaks when agentic AI is scaled before governance is mature?
A: What breaks first is accountability. Teams may still see output, but they lose a reliable way to explain why an agent acted, who approved the scope and whether the action stayed within policy. That creates audit gaps, budget leakage and compliance blind spots across production workflows.
A: AI agents and shadow AI often bypass normal procurement and review, so a static inventory can miss who owns them, what they connect to, and what data they can reach. The risk rises when OAuth grants, inherited permissions, and chat-based workflows are evaluated separately. Correlating those signals shows when access is expanding faster than policy can keep up.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.
Q: What is the difference between shadow IT and shadow AI?
A: Shadow IT is the use of unapproved software, while shadow AI is the use of unapproved or unmanaged generative AI services and embedded copilots. Shadow AI is harder to govern because it often hides inside sanctioned SaaS tools and can move data into external model systems without obvious signs.
Technical breakdown
Why shadow AI breaks static governance models
Shadow AI is not just unapproved software use. It is unapproved reasoning and action, often across multiple systems, where the agent itself can choose what to query, what to pass along, and when to continue a workflow. That creates dynamic data movement that manual inventories and quarterly review cycles cannot keep current. The technical failure is visibility lag: once an agent is updated or chained to another service, the path changes faster than the control plane can record it. Practical implication: governance needs runtime tracing and policy enforcement at issuance and transaction time, not after deployment.
Practical implication: map and control agent data flows continuously, because post hoc review cannot keep up with changing agent paths.
Policy-as-code for agentic AI access and data flow
Policy-as-code moves the control decision into the execution path. Instead of asking a reviewer to approve every prompt, request, or tool call, the system evaluates rules in real time against the request context, identity, and payload. That is especially important for sensitive data, because an agent can attempt to send PII to an external model, query a restricted database, or bridge into an API that was never intended for that workflow. The governance value is not automation for its own sake, but consistent enforcement across many agent interactions. Practical implication: treat data classification, redaction, access control, and audit logging as programmable controls tied to runtime requests.
Practical implication: encode high-risk rules in the execution path so the agent cannot bypass governance through speed or scale.
Why agent-to-agent and MCP-to-API paths expand the attack surface
Agentic systems often span agent-to-agent, agent-to-LLM, agent-to-MCP, and MCP-to-API flows, which means the attack surface is the entire chain, not just the front door. Each hop creates a new trust decision and a new place where data can leak, be transformed, or be forwarded without adequate context. If those hops are governed by separate tools, seams appear between observability, security, and cost controls. That is why the article emphasises a unified platform approach rather than fragmented point solutions. Practical implication: govern every hop in the chain as one identity and policy domain, not as isolated tools with disconnected logs.
Practical implication: unify controls across the full agent path so governance does not fail at the seams between tools.
Threat narrative
Attacker objective: The objective is to move sensitive data through unmanaged AI workflows while staying outside security visibility and governance controls.
- Entry occurs when teams bypass official channels and connect agents directly to external models or third-party AI tools without security review.
- Credentialed access and data handling expand when agents route sensitive customer data, prompts, and context through unmanaged agent-to-agent and agent-to-API flows.
- Escalation follows as new integrations and unauthorized tools multiply the number of paths, blind spots, and untracked permissions in the environment.
- Impact appears as shadow AI incidents, failed audits, forced rollbacks, regulatory exposure, and longer recovery cycles after breaches or compliance findings.
Breaches seen in the wild
- Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
- Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic AI governance is no longer a supporting control. It is becoming the control that determines whether AI deployment remains governable at all. When agents can choose tools, move data, and trigger downstream actions faster than review cycles, the governance model, not the model itself, becomes the security boundary.
Visibility into AI data flows is the new minimum control requirement. The article’s figures show that most organisations still cannot see how AI data moves, which means they cannot reliably authorise it either. That makes data-path mapping a prerequisite for any credible agentic AI programme, not an advanced maturity step.
Shadow AI is a governance failure, not just an asset discovery problem. Unsanctioned agents create reasoning and action paths that ordinary shadow IT controls were never designed to track. The implication is that agent governance must join identity, data, and policy in one operating model if organisations want sustainable deployment velocity.
Runtime governance gap: Manual review assumes a human-paced request can be inspected before impact. Agentic systems compress request, decision, and execution into a single workflow, so the review window collapses and the control fails by design. That broken premise is why governance has to move into the transaction path. Practitioners should treat this as a structural change in identity governance, not a tuning issue.
The market is moving toward platform governance for agentic AI. The article points to a shift away from isolated observability or prompt-defense tools and toward unified control planes that can govern every transaction. That direction validates the need for cross-domain identity governance across NHI, data, and agent behaviour.
From our research library:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
AI governance is shifting from policy review to transaction control. Organisations cannot govern agentic systems by approving them once and assuming the data path stays stable. The operating model has to move to runtime tracing, policy enforcement, and continuous visibility across the full agent chain.
Shadow AI becomes a programme risk when identity and data governance diverge. If teams know who can log in but cannot see what the agent does with the data, the security model is incomplete. That gap is now large enough to affect regulatory posture, incident response, and board-level confidence.
Agentic AI governance maturity will increasingly be judged by runtime control, not documentation. The organisations that can enforce policy at the moment of access will outpace those still relying on after-the-fact reviews. That shift will separate deployable AI from merely approved AI.
For practitioners
- Map every AI data path Document agent-to-agent, agent-to-LLM, agent-to-MCP, and MCP-to-API flows so you can see where data leaves approved boundaries and where blind spots exist.
- Move high-risk checks into policy-as-code Automate PII redaction, rate limiting, access controls, and audit logging so the enforcement point sits inside the request path rather than in a manual review queue.
- Create a single governance plane for agents Align development, platform, security, and compliance teams around one platform model so observability, authorization, and cost controls operate against the same transaction record.
- Inventory shadow AI entry points Identify where teams are using unauthorised models, tools, or integrations so you can prioritise the highest-risk data paths and stop untracked agent sprawl.
Key takeaways
- Shadow AI turns AI adoption into a governance problem because data movement, tool use, and decision-making no longer stay inside predictable control boundaries.
- The article’s numbers point to a large visibility gap and a broad perception of risk, which means most organisations are still trying to govern agentic systems with incomplete telemetry.
- The practical response is to move governance into the runtime path so access, redaction, logging, and authorisation happen where the agent actually acts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent access, tool use, and data movement are central to the governance failure described here. |
| ASI02 — Tool Misuse | The article focuses on agents invoking tools and integrations outside governed channels. | |
| Recommendation — Control agent privileges and tool reach so runtime actions cannot exceed approved identity scope. Restrict tool invocation paths and block unapproved agent access to sensitive systems. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about organising governance for AI systems at enterprise scale. |
| Recommendation — Establish accountable governance roles and policies for AI deployment, monitoring, and escalation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The governance gap centres on whether agents and their integrations are properly authorised. |
| Recommendation — Apply authorization controls to every agent, tool, and integration before data flows are permitted. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | Shadow AI creates pathways for sensitive data to be accessed and moved outside control. |
| Recommendation — Map agentic data leakage risks to credential access and exfiltration techniques in detection engineering. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.
- AI Data Flow: AI data flow is the path information takes as it moves into, through, and out of an AI system. It includes prompts, retrieved context, training data, model outputs, logs, and downstream actions, and it must be governed to prevent leakage, corruption, unauthorized reuse, and unsafe automation.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org