AI actions become reviewable when policy and intent set the context

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Origin's blog post: AI work should be judged against policy, norms and intents separately, because context determines whether an action is acceptable, risky or off-purpose.

Why it matters: This matters for IAM and AI governance because reviewers need a defensible way to distinguish benign agent behaviour from policy drift, unsafe execution and work that no longer matches organisational intent.

Context

AI work review fails when every action is treated as the same kind of signal. A file read, command execution or code change can be normal in one workflow and concerning in another, so governance needs a way to distinguish behaviour from expectation. The separation between policy, norms and intents gives reviewers a clearer basis for judgment than raw activity alone.

Written policy sets the authority boundary, while norms and intents describe observed behaviour and recurring purpose. That is especially relevant for agentic AI, where captured work can show what a system tends to do without proving what it is allowed to do. The starting point here is atypical only if an organisation already treats observed behaviour as enough to govern it.

Key questions

Q: How do I review agent actions against policy and norms?

A: Start by separating what the organisation explicitly requires from what people usually do and what a repeated action appears to be for. Policy answers permission, norms answer normality, and intent answers purpose. Reviewers should escalate only when the action violates the relevant expectation or creates clear operational risk, not simply because it looks different from the average workflow.

Q: Why can normal-looking AI work still be risky?

A: Normal-looking AI work can still be risky because a model or agent may produce sensitive outputs, act on bad prompts, leak training data, or use tools outside its intended scope. The main failure modes are prompt injection, unsafe tool calls, data exfiltration, and hidden policy bypass, so controls like output filtering, tool allow-lists, logging, and human approval matter.

Q: How can teams tell intent from routine in agent logs?

A: Teams tell intent from routine in agent logs by correlating the prompt, tool call, data touched, and sequence of actions against the agent’s approved task and scope. Routine activity follows expected workflows and permissions, while intent is inferred from deviations such as unusual destinations, privilege escalation attempts, repeated retries, or calls that match exfiltration or policy-bypass patterns.

Q: What should security teams do first when AI behaviour becomes hard to predict?

A: Start by defining who can intervene, under what conditions, and with what technical mechanism. Then verify that those intervention paths work in practice. Until a team can stop or constrain the system at runtime, it should not assume the governance model is complete.

Technical breakdown

Why policy, norms and intents are different control layers

Policy is the explicit rule set, norms are the recurring patterns observed in practice, and intents are the purposes inferred from repeated work. These are related but not interchangeable. A norm can be widespread and still be undesirable, while an intent can explain why a sequence of actions made sense without proving it was authorised. In AI work review, the distinction matters because the same output can be judged differently depending on which expectation is being tested. Keeping the layers separate prevents reviewers from mistaking observed regularity for approval.

Practical implication: Map each AI action to the expectation it should satisfy before deciding whether it merits investigation.

How agent work becomes evidence of organisational intent

Intent is not a statement the system makes about itself. It is an inference built from repeated actions across captured work, especially when similar sequences appear across different users or tasks. That makes intent useful for spotting recurring objectives, but also easy to over-read. A prerequisite action may support an objective without being the objective itself, and tangential work can sit nearby without being harmful. For governance, intent is a context signal, not a policy substitute.

Practical implication: Use intent as a review aid, but require policy or explicit ownership before treating a recurring purpose as acceptable.

Why harmless deviations still matter in AI operations

A deviation from a norm is not automatically a security issue. Some differences are justified by local context, changing requirements or a better way to achieve the same goal. The control problem is deciding when a departure introduces risk, wastes effort or interferes with other work. That means reviewers need to look for both the expectation and the consequence, rather than assuming that every difference is equally important. In practice, this is how AI operations avoid turning every exception into an incident.

Practical implication: Escalate only when the deviation changes risk, policy compliance or operational outcome.

Threat narrative

Attacker objective: The objective is to hide risky or policy-breaking agent activity inside patterns that look normal enough to avoid scrutiny.

1. Entry occurs when an agent receives a task or prompt that can shape how work is interpreted against policy, norms and intents.
2. Escalation follows when captured actions are evaluated only as behaviour, allowing risky or off-purpose work to blend into routine activity.
3. Impact is a governance failure: reviewers miss the expectation that was violated and either over-escalate benign work or under-escalate harmful work.

NHI Mgmt Group analysis

Policy, norms and intents are distinct governance layers, not competing explanations. Origin's framing is useful because it separates what is allowed, what is common and what an action is trying to achieve. That distinction is essential in agentic environments where behaviour can be technically normal and still be out of policy. Practitioners should treat the three as different review lenses, not one blended judgment.

Captured AI work creates evidence, but evidence is not endorsement. Repeated behaviour can reveal organisational practice, yet repeated practice may still be outdated, harmful or simply undocumented. That is why a stable pattern should trigger questions about whether the rule needs correction or the practice needs formalisation. The important governance move is to avoid turning observation into approval by default.

Agent review needs a named expectation before it needs a verdict. The article's central value is methodological: reviewers must identify the specific policy, norm or intent an action relates to before deciding whether it deserves attention. That makes the concept of an expectation gap more precise than a generic anomaly label. In practical terms, AI governance gets stronger when reviewers can say which expectation failed, not just that something looked unusual.

Expectation gap: the gap between what a captured AI action shows and the expectation it should satisfy. That gap can be between policy and practice, or between a routine pattern and the purpose the work was supposed to serve. Naming the gap helps teams decide whether to investigate behaviour, correct a process, or revise the rule set.

Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Expectation gap: AI governance gets more precise when reviewers can name the specific expectation that was violated instead of relying on a generic anomaly label. That shift matters because agent behaviour can be normal in form while still being out of policy, and policy should remain the higher authority.

Captured work will increasingly be used to infer how organisations actually operate, which means review systems need stronger context capture around task type, business function and purpose. Without that context, the same action can be misclassified as routine, risky or intentional depending on who reviews it.

The practical direction is toward evidence-based governance rather than behaviour-only governance. Teams that separate policy, norms and intents will have a better chance of deciding whether to investigate an agent, correct a practice or revise a written rule.

For practitioners

• Define review against three separate expectations Build review guidance that asks whether an action was allowed, whether it matched established practice and whether it served the intended objective before escalation decisions are made.
• Capture repeated work patterns with local context Record the workflow, business unit and task context when logging agent activity so that repeated behaviour can be interpreted correctly rather than treated as universally normal. See the AI Agent Observability, Audit and Incident Response Guide.
• Require an explicit expectation for escalation Make every review note name the policy, norm or intent at issue, because unexplained concern is not enough to support a governance decision. See the Agentic AI Security Policy Template.
• Separate harmless variation from risk-bearing deviation Train reviewers to distinguish differences that are merely alternate ways of working from differences that increase exposure, waste effort or interfere with other work.

Key takeaways

• AI work needs to be judged against policy, norms and intent separately because the same behaviour can be acceptable, risky or off-purpose depending on context.
• Observed patterns in captured agent work can reveal how an organisation operates, but they do not automatically prove that the organisation endorses that behaviour.
• Governance improves when reviewers name the exact expectation at issue before deciding whether to investigate, correct practice or change the rule.

Related NHI Mgmt Group resources: Agentic AI Security Policy Template · AI Agent Observability, Audit and Incident Response Guide · AI Agents vs Agentic AI

Key terms

• Policy: Policy in an agent system is the effective behaviour produced by the model, scaffold, tools, and harness together. In practice, it is broader than model versioning because changes to prompts, permissions, or runtime logic can alter what the system does.
• Intent: Intent is the structured description of what an agent is trying to do, including target resource, operation, scope, and purpose. Translating prompts into intent makes policy evaluation possible before access is granted, which is essential when natural-language requests drive enterprise actions.
• Expectations Gap: The mismatch between how a service provider describes its work and how a buyer measures its value. In identity and security programmes, it appears when teams talk about tools, tickets, or uptime while stakeholders care about risk, productivity, and cost.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It helps practitioners connect operational evidence to access, ownership and lifecycle controls.