TL;DR: As agentic AI systems move beyond single prompts into agent-to-agent execution, autonomous tool use and chained reasoning create new trust, compliance and security risks that traditional AI controls were not designed to handle, according to Tumeryk. Runtime policy enforcement and observability now matter more than after-the-fact review because agent decisions can propagate before teams ever see them.
At a glance
What this is: This is Tumeryk's analysis of why agentic AI needs runtime trust, policy and observability controls, not just post hoc monitoring.
Why it matters: It matters because security teams managing AI, IAM and governance now need controls that evaluate agent actions as they happen, especially where delegated access, policy boundaries and auditability intersect.
Context
Agentic AI changes the control problem because the system is no longer just generating text. It is selecting actions, calling tools and passing context across agents, which means trust decisions have to happen during execution, not after the fact.
That shift creates a governance gap for agent identity and lifecycle because classic AI controls were built for model safety, not for runtime delegation, policy enforcement and agent-to-agent trust evaluation.
Key questions
Q: How should security teams govern agentic AI when agents can delegate to sub-agents?
A: Treat delegation as a first-class identity boundary. Define who can spawn sub-agents, how deep delegation may go, what scopes can be inherited, and when the chain must be revalidated. Without those controls, authority can expand faster than governance can attribute it, which is exactly where autonomous systems become difficult to contain.
Q: Why do traditional AI controls fall short for agent-to-agent workflows?
A: Traditional AI controls usually focus on model output, content safety or later audit. Agent-to-agent workflows add delegated action, tool use and chained reasoning, which means the security decision must happen before the next step is executed. If controls only observe after the fact, unsafe behaviour can spread across the chain.
Q: What are the best practices for observability in agentic AI systems?
A: Capture the full decision trail, not just the final output. The most useful signals are the agent call, response, trust score, policy decision and downstream action, because those let teams attribute behaviour, investigate incidents and prove enforcement. Logging only the end result leaves too much context missing for governance.
Q: Should IAM teams be involved in AI agent governance from the start?
A: Yes, because AI agents inherit access, secrets, and revocation problems that are already IAM concerns. IAM teams should define entitlement boundaries, session scope, audit expectations, and offboarding rules before the first production rollout. If those controls are deferred, the programme will scale faster than it can be governed.
Technical breakdown
How runtime trust scoring changes agent control points
Runtime trust scoring evaluates each agent interaction at the moment it occurs, instead of relying on logs or later review. In an agentic workflow, the system must assess context, requested action, policy fit and risk before the agent propagates outputs or invokes another tool. That is different from traditional monitoring, which records what happened but does not decide whether the action should continue. Embedding the trust score in the response payload makes the decision part of the execution path rather than a separate security layer. This matters when chained reasoning and delegated actions can amplify a single unsafe decision across multiple agents. See the AI Agent Authorisation Guide.
Practical implication: Treat trust evaluation as an execution control, not a reporting control.
Why policy boundaries matter more than model prompts
Prompts can influence behaviour, but policy boundaries define what the system is allowed to do. In agentic AI, the important control is not just whether the model can produce a safe answer, but whether the agent can take a permitted action, use a tool or hand off to another agent. Policy enforcement therefore has to sit between intent and execution. No-code policy authoring is relevant because enterprise teams need to express limits in a form that can be applied consistently across changing workflows. Without that layer, policy becomes a documentation exercise rather than an operational constraint. See the Agentic AI Security Guide.
Practical implication: Place enforceable policy between agent intent and tool execution.
Why observability must cover agent decisions, not just logs
Agentic observability needs to capture the call, the response, the trust decision and the policy outcome together. A log record that only shows final output leaves a blind spot when an agent has already consumed context, called a tool or passed control onward. Observability is strongest when it supports traceability across the agent lifecycle and ties security signals to business actions. That makes audit, incident review and compliance evidence much more defensible. The control goal is not volume of telemetry, but attribution of decision-making across the chain. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Instrument agent actions so security teams can reconstruct delegated decisions end to end.
NHI Mgmt Group analysis
Runtime trust is becoming the new security boundary for agentic AI. Once agents can invoke tools and delegate work to other agents, a delayed review model no longer contains risk. Trust scoring at execution time is the more defensible pattern because the decision can be stopped before an unsafe action fans out across the workflow. Practitioners should treat the trust signal as part of the control plane, not as an analytics overlay.
Agent policy must be enforceable, not merely describable. Enterprise AI governance fails when policy exists only in prompts, documentation or review workflows. Declarative policy that is evaluated during execution turns governance into an operational constraint, which is where it belongs. That is the practical difference between promising safety and governing it.
Contextual enforcement gap: agentic systems fail when conversational state, tool use and delegation are governed separately. The article's core point is that context, policy and observability have to move together because a trust decision made outside the execution path arrives too late. Teams should map where context is created, where policy is applied and where evidence is stored.
Continuous red teaming is a control validation mechanism, not a one-time assurance activity. Agent behavior changes as models, tools and policies change, so guardrails need repeated testing to expose regressions and bypass paths. That is especially relevant where audit evidence and compliance claims depend on the same runtime controls that are supposed to block unsafe behaviour. Practitioners should test the control, not just the model.
Agentic AI governance now overlaps directly with identity governance. When an agent acts on behalf of a user or system, the security question becomes who or what is authorised to act, with what scope, and under which policy. That makes AI agent identity and delegation a first-class governance issue, not a niche technical detail. Teams should align agent registration, delegation and revocation with existing IAM and agent identity and lifecycle practices.
From our research library:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Authorisation Guide
What this signals
Trust scoring will become a governance primitive for agentic AI. The practical shift is from monitoring outputs to controlling execution, which makes identity, policy and observability part of the same operating model. Teams that keep those functions separate will struggle to prove that an agent acted within authorised bounds.
AI governance debt accumulates when policy is decoupled from runtime. The longer organisations rely on prompts, documentation or retrospective review, the harder it becomes to explain why an action was allowed. That gap is especially visible when agents delegate, chain tasks or operate across systems with different owners.
69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That is a signal that identity programmes are no longer only about human users and service accounts; they now have to account for delegated machine action, runtime policy and revocation at speed.
For practitioners
- Implement runtime trust evaluation Score every agent call at execution time and block or step up when the trust score indicates policy, data exposure or behaviour risk.
- Define explicit policy boundaries Express what agents may do, which tools they may invoke and which delegation paths are forbidden, then enforce those limits in the control layer. See the Agentic AI Security Guide.
- Record decision-level observability Capture the call, response, trust score and policy outcome together so security, compliance and incident teams can reconstruct agent behaviour. See the AI Agent Observability, Audit and Incident Response Guide.
- Align agent identity with governance Register agents, scope delegated authority and retire access when the task or system changes so the identity model matches operational reality.
Key takeaways
- Agentic AI changes the control boundary by turning trust into an execution-time decision instead of a retrospective review problem.
- The operational challenge is not only model safety but the combination of delegation, policy enforcement and observability across agent chains.
- Identity governance now has to cover who or what is authorised to act, how that authority is scoped and how quickly it can be revoked.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic AI Security Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent-to-agent delegation and policy enforcement create identity and privilege abuse risk. |
| Recommendation — Apply ASI03 to constrain delegated agent authority and block privilege expansion during execution. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Runtime trust and agent identity depend on strong authentication between agents and tools. |
| Recommendation — Use NHI-04 controls to authenticate agents before they can invoke tools or pass control onward. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about governing AI behaviour and accountability at runtime. |
| Recommendation — Establish GOVERN controls that assign accountability for agent decisions, policy enforcement and audit evidence. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent actions must remain within authorised permissions and delegated scope. |
| Recommendation — Apply PR.AA-05 to review and constrain agent permissions against task-specific authorisation. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Agent chains can amplify credential use and movement across tools and systems. |
| Recommendation — Map agent abuse scenarios to TA0006 and TA0008 to hunt for credential misuse and movement across delegated paths. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Trust Scoring: Trust scoring is a risk-ranking method that assigns a relative confidence or exposure level to an identity, request, or entitlement. In identity governance, it helps prioritise review work and automation decisions. It must be explainable, otherwise it becomes a black box that weakens auditability.
- Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
- Observability For Agentic AI: The ability to reconstruct what an AI agent accessed, which tools it used, and what outputs it produced during a session. This is more than logging prompts. It provides the evidence needed for security review, incident investigation, and compliance validation.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and agentic AI identity for practitioners building governance into real-world systems. It helps security and IAM teams align identity controls with the way autonomous systems actually operate.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org