AI agent governance now depends on action-level control

At a glance

What this is: This is an analysis of why AI governance now has to focus on agent actions, with the central finding that session-level visibility and runtime controls matter more than prompt review.

Why it matters: IAM, IGA, PAM, and NHI teams need to treat AI agents as active executors whose permissions, tool use, and action outcomes must be governed at runtime, not just at setup.

Context

AI agent governance is now an action problem, not only a content problem. The article argues that enterprises can no longer stop at reviewing prompts or blocking obvious data leaks, because the material risk sits in what an agent actually does once it starts working.

That shift matters for identity governance because agents operate as non-human executors with delegated access, tool use, and policy exposure. Existing control models were built to watch users, sessions, and outputs, but not to govern sequences of agent actions across browser, endpoint, network, and API surfaces.

The article frames this as a gap in runtime visibility and policy enforcement across the agent lifecycle. That starting point is increasingly typical for organisations adopting AI agents in production rather than an edge case.

Key questions

Q: What breaks when AI governance only monitors prompts and outputs?

A: Prompt and output monitoring misses the moment where the real risk occurs, which is execution. An agent can produce a harmless-looking response while still calling APIs, updating records, or chaining actions across systems. Governance that stops at the conversation layer cannot see the blast radius created by runtime action.

Q: Why do session-level controls matter for AI agent risk?

A: Because one isolated event rarely shows the full behaviour. Session-level controls connect the prompt, tool use, file access, and response into one chain, which makes it possible to judge whether the agent stayed within its intended scope. Without that chain, security teams see fragments, not abuse.

Q: What signals show that an AI agent is operating outside its intended purpose?

A: Look for mismatches across identity, data, model behaviour, posture, and environment. A clean authorization trail is not enough if the agent starts touching unrelated data, follows injected instructions, drifts from its known configuration, or continues acting in a way that does not fit the task.

Q: How should security teams respond when an AI agent attempts a risky action?

A: They should interrupt the action before it becomes permanent, explain the denial in terms the agent can use, and log the event for review. If the workflow can continue safely, the agent should be redirected into a permitted path rather than simply shut down.

Technical breakdown

Why agent actions are the security boundary

AI agents do not just generate text. They can call tools, move files, run commands, touch endpoints, and trigger irreversible changes inside business systems. That makes the risky unit of analysis the action sequence, not the prompt alone. A single tool call can look benign in isolation while the full session reveals data movement, privilege use, or destructive intent. For identity governance, this is closer to runtime authorisation than content moderation. The control question becomes whether the agent should be allowed to do a specific thing in a specific context, not whether the prompt was acceptable.

Practical implication: govern agent permissions at the action layer, not only at prompt intake.

Why session-level visibility matters for agentic identity

The article describes a governance problem created by fragmentation. Browser tools, endpoint tools, network tools, and API integrations each see only a slice of what the agent did, which means no single control point understands the full chain. Session-level visibility reconstructs that chain by tying prompts, tool calls, files accessed, and responses to one agentic session. That is the difference between logging an event and understanding behaviour. For NHI and agentic AI governance, this is essential because a delegated identity can look compliant at the point of use while the session as a whole is not.

Practical implication: correlate agent activity across surfaces before deciding whether a control failed.

How runtime policy enforcement changes AI governance

The article’s runtime model is not just detect-and-alert. It allows policy to allow, prompt for confirmation, or block an action while telling the agent why. That matters because many AI agents will keep executing if they receive a reasoned denial, rather than collapsing the workflow. From a governance perspective, this is a boundary control for agentic behaviour, comparable to privileged session controls in PAM but applied to action execution. The central issue is not whether the system can observe the agent after the fact, but whether it can interrupt harmful action before the outcome becomes permanent.

Practical implication: place approval, blocking, and audit at the point of execution, not after the session ends.

Threat narrative

Attacker objective: The objective is to get the agent to perform harmful actions that produce data loss, unauthorised disclosure, or destructive operational change while appearing to execute a valid workflow.

1. Entry occurs when an agent receives a task and is allowed to operate inside the applications, endpoints, or cloud frameworks already in use.
2. Credentialed or delegated access is then used to make tool calls, retrieve files, and invoke skills or sub-agents that expand what the agent can touch.
3. Escalation appears when the agent follows a hidden instruction, runs an unauthorised script, or takes a destructive action that crosses the intended task boundary.
4. Impact is realised when data leaves the environment, a production database is deleted, or another permanent change is carried out before a human intervenes.

NHI Mgmt Group analysis

Action-level control is now the governing unit for AI agents. The article shows that prompt review is too early and output review is too late when an agent can call tools, move files, and execute commands mid-session. That makes the action itself the control boundary, because the material security decision happens at the point of execution. Practitioners should treat agent actions as governed events, not passive outputs.

Session fragmentation is the new visibility failure. Browser telemetry, endpoint telemetry, and network telemetry each capture different fragments of the same agent behaviour, but none of them on their own explain intent or outcome. That is the governance gap the article surfaces: fragmented evidence without a reconstructed session cannot support reliable authorisation or incident triage. Practitioners need a session model that ties the agent, the person, the tools, and the resource touched into one record.

Identity for agents only works if the agent is differentiated from the user it represents. The article’s identity problem is not simply authentication, but attribution and scope. When an agent acts on behalf of a user, the governance model has to preserve who requested the task, which identity executed it, and what that identity was actually allowed to do. Practitioners should stop treating delegated execution as transparent user activity.

Runtime denial has to be understandable to the agent, not just enforceable. The article shows that a blocked agent can continue successfully if it receives an explanation and can rewrite its action path. That creates a new governance pattern in which policy enforcement and adaptive redirection sit together. For practitioners, the implication is that agent controls now have to manage behaviour in motion, not merely generate rejection events.

Action visibility is the named concept that will separate AI governance from legacy monitoring. The article’s core contribution is not more telemetry, but the idea that enterprises need visibility into what an agent does at the point it does it. That concept matters because action visibility is what turns runtime authorisation, audit, and containment into one control plane. Practitioners should evaluate agent governance on that basis, not on prompt inspection alone.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Action visibility: AI governance is moving from model oversight to execution oversight, because the control problem is no longer what the agent says but what it is allowed to do. Programmes that cannot reconstruct a full session will struggle to prove whether a delegated identity stayed within scope.

Security teams should assume that browser, endpoint, network, and API telemetry will each miss part of the same agentic event. The practical response is to build one governance view that ties action, identity, and context together before the session closes.

The visibility gap is especially important for delegated execution, where the person who requested the task is not the same thing as the identity that carried it out. That distinction now belongs in policy, review, and incident handling.

For practitioners

• Govern the action layer Define policy around specific agent actions such as file transfer, command execution, and database modification rather than around prompts or outputs alone.
• Reconstruct the full agent session Correlate browser, endpoint, network, and API events into one session record so that tool use, resource access, and responses are analysed together.
• Differentiate agent identity from user identity Track which identity the agent acted under, which user requested the task, and where delegated access expanded the effective blast radius.
• Block destructive tool calls at runtime Apply policy decisions before irreversible actions such as deletion, external transfer, or unauthorized script execution complete.
• Discover shadow AI agents before governance starts Inventory agents across endpoints, browsers, and cloud frameworks so that ungoverned execution paths do not remain invisible.

Key takeaways

• AI agents change the security problem from content moderation to action governance because the harmful event happens when the tool call executes.
• Fragmented telemetry is insufficient when different controls only see isolated parts of a session and cannot explain the full sequence of agent behaviour.
• Runtime policy enforcement is the decisive control because it can stop or redirect destructive actions before they become permanent.

Key terms

• Action-level control: Action-level control is policy enforcement applied to each request, tool call, or data access rather than to the session as a whole. It is especially relevant for AI agents because their behaviour changes too quickly for static session controls to describe the real risk boundary.
• Session Visibility: Session visibility is the ability to see what an identity actually did during an access session, not just that access occurred. It usually includes commands, queries, timestamps, and resource changes, which makes it vital for forensics, scoping, and accountability after a breach.
• Delegated Agent Identity: An identity used by one actor to act on behalf of another under explicit scope and policy. In agentic environments, this can describe both human-authorised assistants and machine-to-machine handoffs, so the delegation path must remain auditable at every step.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.