Agentic AI governance needs an agent registry, not just model review

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Lumenova AI's blog post: Agentic AI breaks governance models designed for recommendation-only systems, because the real control point shifts to the agent, its permissions, and runtime enforcement.

Why it matters: IAM, GRC, and AI governance teams need to treat agent identity, scope, logging, and accountability as first-class controls, not as side effects of model oversight.

Context

Agentic AI changes governance because the system no longer stops at output generation. Once an agent can plan, call tools, and execute actions, the governance problem becomes one of permission, accountability, and runtime control rather than simple content review.

The key gap is that many existing AI governance programmes still assume a human sits between recommendation and action. That assumption fails when an agent updates records, sends communications, or delegates work to another agent without waiting for approval.

Key questions

Q: What breaks when agentic AI is governed like a normal application account?

A: Security controls break down because agentic systems do not behave like fixed-function applications. They can choose actions at runtime, combine tools in unexpected ways, and move faster than periodic review cycles. That means static roles, annual recertification, and one-time approvals do not fully describe the risk or contain the behaviour.

Q: Why do AI agents need explicit permissions and not just prompt rules?

A: Prompt rules are advisory, but permissions are enforced by the system that actually grants access. If an agent has a credential that can write records, send messages, or trigger transactions, a prompt telling it not to do so is not a control. Effective governance limits actions in the identity layer and enforces those limits at runtime.

Q: How do organisations know if agentic AI governance is actually working?

A: Look for three signals: access decisions tied to task context, complete audit records linking agents to datasets, and rapid revocation when scope changes. If reviewers still need manual reconstruction after an incident, the programme is not mature. Effective governance produces explainable access, not just allowed or denied results.

Q: Who should own AI agent risk in DTC organisations?

A: Ownership should sit with the business process owner and the security or IAM function together, because the agent's decisions affect customer outcomes, data handling and access governance. If ownership is split too loosely, no one can reliably revoke, approve or audit the agent's authority.

Technical breakdown

Why model inventories fail for agentic AI

A model inventory records what was built or purchased, but it does not capture the distinct permissions, tools, data access, and autonomy that an agent uses at runtime. Two agents on the same model can create very different risk profiles if one can only read while another can write, transact, or invoke other agents. That is why governance has to attach to the agent as an operational unit, not to the model as a static artefact. The practical consequence is that inventory must include owner, use case, permitted actions, connected systems, and human checkpoint points. See the [[L3|Agentic AI Identity Guide]]. See the Agentic AI Identity Guide.

Practical implication: maintain an agent registry that records scope, ownership, and action permissions for every agent in production.

How runtime permissions differ from prompt-level policy

Prompt instructions are advisory. Permissions enforced in the identity layer are controlling. An agent that is told not to issue refunds still has the ability to do so if the underlying credential, service account, or delegated token allows it. Governance therefore has to move from content constraints to action constraints, where the system evaluates whether a read, write, transact, communicate, or delegate operation is allowed before execution. This is also where policy-as-code matters, because the control must be machine-enforceable at the moment of action, not merely documented in an AI policy. See the AI Agent Authorisation Guide.

Practical implication: define allowed actions per use case and enforce them through access controls, not through prompt wording alone.

Why audit logging must capture action chains, not just prompts

A prompt and response pair reconstructs a conversation, not a decision. Agentic systems create multi-step chains that may include tool calls, branching logic, handoffs to other agents, and human checkpoints that were skipped or never triggered. If the log stops at input and output, investigators cannot explain why a claim was approved, why a record changed, or which tool call caused the outcome. Effective logging therefore needs to capture action sequence, parameters, returns, and inter-agent transfers as first-class events. That is the minimum evidence needed for accountability and post-incident review. See the [[L11|AI agent observability guide]]. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: log tool calls, branches, and agent handoffs so every outcome can be reconstructed end to end.

Threat narrative

Attacker objective: The objective is to use agentic action paths and over-scoped permissions to make unauthorised changes or trigger harmful business outcomes before governance catches up.

1. Entry occurs when an agent is enabled inside an existing platform or workflow, often without a formal change request or registration step.
2. Credential use follows when the agent inherits permissions from a service account or delegated identity that was not scoped for autonomous action.
3. Escalation happens when the agent can write to systems, call tools, or delegate steps to other agents beyond the original human review model.
4. Impact is the execution of unauthorised or poorly governed business actions at machine speed, with weak attribution and delayed detection.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI governance fails when the model is treated as the governed unit. The article is right to shift the control boundary to the agent, because permissions, ownership, and auditability all attach to the thing that acts. Governance frameworks that only review model behaviour miss the point that a separate runtime actor can inherit the same model and execute entirely different outcomes. The practical implication is that AI governance programmes need an agent registry as the first control surface.

Access control, not prompt policy, becomes the decisive governance layer. If an agent can read, write, transact, or delegate through an existing credential, the prompt is not a control. That makes agent permissions an IAM and PAM problem as much as an AI policy problem, and it pulls agent oversight into the same governance discipline used for privileged access. The practical implication is to bind every agent to explicit action scope and approval rules.

Runtime tracing is the named control gap that agentic systems expose. The article surfaces a clear governance failure mode: decision chains that cannot be reconstructed after the fact because logging was designed for conversational exchange, not autonomous action. That is a different problem from simple observability, and it matters because regulated workflows need evidence, not just alerts. The practical implication is to treat tool-call traces and agent handoffs as governed records, not optional telemetry.

Governance debt: strategies written for model review accumulate risk once agents can act without human sign-off. The older the strategy, the more likely it assumes a person remains the final control point. Once that assumption disappears, the organisation is carrying a control model that looks complete on paper but is incomplete in operation. The practical implication is to re-baseline governance around autonomous action, not around model output.

Identity is the missing bridge between AI governance and operational control. The article makes clear that an agent's real risk comes from what it can do with identity, delegation, and authority, not from the model alone. That is why agentic AI compliance and identity governance now overlap in the same programme. The practical implication is to align AI governance review with identity lifecycle, permission design, and accountability assignment.

From our research library:

• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Runtime action is the new governance boundary. Agentic AI forces security teams to move from reviewing outputs to governing action in real time. That shift matters because the control point changes from approval after generation to enforcement before or during execution, and programmes that miss that transition will under-govern the most consequential systems in production.

Governance debt is now a programme risk. A strategy that assumes a human remains between recommendation and execution will age out quickly as agents expand into business workflows. Organisations should re-baseline AI governance around identity, delegation, and permission scope before those assumptions become embedded in operations.

69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That signal matches the article's central point: the agent, not the model, is now the unit of governance, and identity controls need to move with it.

For practitioners

• Build an agent registry Record every production agent's owner, business use case, permitted actions, connected tools, data access, and human checkpoint so governance attaches to a real operational unit.
• Move permissions into the identity layer Define whether each agent may read, write, transact, communicate externally, or invoke other agents, and enforce those limits through credentials and delegated authority rather than prompts.
• Extend audit logging to action chains Capture tool calls, parameters, returns, branching decisions, and agent-to-agent handoffs so investigators can reconstruct the full decision path after the fact.
• Assign accountability per agent use case Name one accountable executive for the business outcome and one technical owner for each use case, then define who can suspend the agent and who reviews the event afterwards.
• Test runtime guardrails before production scope expands Validate whether policy breaches are blocked during execution, not just detected later, especially where vendors enable new agentic features by default.

Key takeaways

• Agentic AI breaks governance models that only review model outputs, because the system itself can now act.
• The strongest control shift is from model oversight to agent identity, permissions, runtime tracing, and accountability.
• Programmes that cannot inventory agents or reconstruct their action chains will struggle to govern autonomous behaviour in production.

Related NHI Mgmt Group resources: Agentic AI Compliance Guide · Agentic AI Identity Guide · Agentic AI Identity Risk Board Briefing · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Agent Registry: An agent registry is a central catalog of sanctioned and shadow AI agents, including their identities, permissions, and lifecycle state. Its value depends on whether it feeds broader governance, because a registry without telemetry, ownership, and offboarding can become another silo.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Action Chain Logging: The practice of recording the full sequence of agent actions, including tool calls, parameters, returns, and handoffs to other agents. It gives investigators and auditors evidence of how a decision was made, not just what the model said.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners connect identity controls to the operational reality of autonomous systems.