AI agent governance still breaks at discovery, runtime, and scope

At a glance

What this is: This is a comparative analysis of AI agent security platforms, with the central finding that discovery and governance alone do not close runtime and MCP risk.

Why it matters: It matters because IAM, IGA, PAM, and security architects now need controls that govern AI agents as runtime identities, not just inventory them after deployment.

👉 Read Akto's comparison of Zenity and Akto for AI agent security

Context

AI agent security is no longer a speculative category. Enterprises are deploying agents across SaaS tools, cloud platforms, and endpoints, which means the identity problem is shifting from user sessions and service accounts to systems that can select tools, access memory, and act across multiple runtime contexts.

The governance gap is that many current controls still assume a stable, reviewable identity posture. That works for static entitlements, but it does not fully address agent behaviour that changes with prompts, connected tools, and execution paths. For background on the risk model, see OWASP NHI Top 10 and the OWASP Agentic AI Top 10.

In this article, the vendor frames the market around discovery, posture, detection, and red teaming. That structure is useful because it exposes the real decision point for practitioners: whether a platform is only observing agent activity or actually reducing blast radius when agents behave outside intended scope.

Key questions

Q: How should security teams govern AI agents that can choose tools at runtime?

A: Security teams should govern runtime agent choice as an access event, not as a simple application action. That means scoping permissions to the task, limiting token lifetime, logging every tool decision, and blocking the agent from reaching systems outside its approved context. Static roles alone are not enough when the execution path changes on each run.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when agent security stops at discovery and posture review?

A: Discovery and posture review can show that an agent exists and appears compliant, but they do not prove the agent behaves safely under real conditions. If runtime controls are missing, a prompt injection, a bad tool chain, or a weak MCP definition can still drive unintended access and data movement. Visibility without enforcement leaves the organisation observing risk instead of reducing it.

Q: How should teams govern AI agents that use MCP?

A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.

Technical breakdown

AI agent observability and shadow discovery

AI agent observability means continuously inventorying agents, their owners, permissions, connected tools, memory stores, and runtime relationships. In agentic environments, shadow AI is not only an undiscovered model endpoint. It can be an approved platform feature, a departmental workflow, or a developer-built agent operating outside central governance. Event-driven discovery matters because permission and connector changes can happen faster than periodic posture scans can detect. That makes inventory quality a live security control, not an administrative report.

Practical implication: replace periodic agent inventories with event-driven discovery that captures ownership, permissions, and connectors as they change.

AISPM and posture controls for agent permissions

AI security posture management for agents evaluates how an agent is configured before it runs. The relevant objects are not just the model or prompt, but instructions, memory access, tool integrations, and delegated permissions. This is where governance still matters: if the platform cannot show who approved an agent’s scope and what it can reach, security teams are left with blind trust. AISPM is therefore the bridge between policy intent and agent execution boundaries.

Practical implication: require posture checks on every agent before production use, with explicit review of tools, memory, and delegated permissions.

Runtime detection, tool misuse, and MCP security

Runtime detection looks at decision paths, tool invocations, and execution flow rather than isolated prompts. That matters because the security issue is often not a bad prompt in isolation, but a sequence of actions that escalates from legitimate access into unintended behaviour. MCP adds another layer because agents depend on tool servers to reach data and actions. If those tool definitions, policies, or protocol boundaries are weak, the agent can turn a narrow permission into a wider operational impact.

Practical implication: pair runtime behavioural detection with dedicated MCP testing, because prompt filtering alone will not catch tool-chain abuse.

NHI Mgmt Group analysis

Governance-first AI agent security is necessary but incomplete. Discovery and policy control matter, especially when enterprises cannot even name all the agents running in their environment. But governance does not equal containment if the platform stops at posture and inventory. The central weakness is the assumption that visibility over an agent is enough to control its behaviour. Practitioners need to treat governance as the baseline, not the finish line.

Agentic security introduces a runtime identity problem, not just a configuration problem. Traditional IAM and IGA can describe who or what should have access, but AI agents can combine tools, memory, and timing in ways that change the practical meaning of access mid-session. That is why runtime behaviour and tool use become first-class identity signals. The implication is that identity programmes must evaluate action paths, not only assigned entitlements.

Generic NHI controls do not fully address MCP and developer-built agents. SaaS-focused coverage can leave gaps in custom agent frameworks and internal API chains, where the real blast radius often lives. This is where the runtime governance gap becomes visible: the organisation thinks it has visibility because a platform can observe some agents, but the highest-risk execution paths remain outside its coverage. Practitioners should map control boundaries to actual agent construction patterns.

Agent identity governance now spans discovery, red teaming, and response. A platform that only inventories agents cannot tell you how they fail under pressure, while a platform that only tests them cannot tell you what exists in production. The field is moving toward layered control models because AI agents are both identities and actors. Security teams should expect procurement, architecture, and assurance conversations to converge on runtime enforcement rather than isolated visibility claims.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• Our research also shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For a broader identity baseline, see The State of Non-Human Identity Security, which reports that only 1.5 out of 10 organisations are highly confident in securing NHIs.

What this signals

With 98% of organisations planning to expand AI agent deployment, the governance problem is now scale, not curiosity. Security teams should expect more shadow agents, more connector sprawl, and more pressure on IAM and IGA programmes to classify machine decision-makers correctly. The practical shift is toward runtime oversight, not periodic attestation.

Runtime governance gap: the real control deficit is not whether an agent exists, but whether the organisation can explain what it can do at the moment it does it. That is why posture review, red teaming, and behavioural detection need to operate together. For a framework view, the OWASP Agentic AI Top 10 is a useful reference point.

For IAM, PAM, and NHI programmes, the next planning question is whether controls assume fixed credentials or dynamic execution paths. Where agents can switch tools, touch memory, and span multiple platforms, policy needs to follow behaviour rather than just identity labels. That makes agent inventory quality and change detection a programme-level requirement.

For practitioners

• Map every agent to an owner, tool chain, and data boundary Build an inventory that includes SaaS-managed agents, homegrown agents, and endpoint-based assistants. Record ownership, connected tools, memory stores, and data sources so security can see where each agent can act and who is accountable when it does.
• Test agent behaviour under adversarial conditions Use red teaming or equivalent probe libraries to validate prompt injection resistance, tool misuse handling, permission escalation resistance, and data exfiltration paths before production rollout. Treat runtime failure as a design input, not a post-incident surprise.
• Control the MCP tool surface directly Review MCP server definitions, tool permissions, and protocol-level access paths separately from model access. The point is to secure the tool-calling surface, not only the prompts that reach it.
• Require production gates for agent posture drift Set change controls for permissions, connectors, instructions, and memory access so that a new tool or scope change cannot silently expand blast radius. Revalidate the agent whenever those boundaries move.

Key takeaways

• AI agent governance fails when teams rely on inventory and posture alone, because runtime behaviour can still exceed intended scope.
• The evidence points to a widening gap between deployment speed and control maturity, especially where agents use tools, memory, and MCP integrations.
• Practitioners should align discovery, red teaming, and runtime enforcement so that agent identity is governed as an active access problem.

Key terms

• AI Agent Security KPI: A measurable indicator used to show whether security controls for AI agents are working in production. Unlike a simple compliance metric, it should tie discovery, monitoring, enforcement, or remediation to an observable result that helps a team decide what to harden, block, or investigate next.
• AI Security Posture Management: A governance approach for discovering and tracking AI assets such as models, agents, datasets, vector stores, and related infrastructure. It becomes useful only when inventory is connected to runtime exposure and the identity that can actually reach the data.
• MCP: Model Context Protocol, an open way for AI agents to connect to tools and data sources. It improves interoperability, but it also introduces a shared integration layer that must be governed carefully because the protocol can widen access across many systems at once.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

What's in the full article

Akto's full blog post covers the operational detail this analysis intentionally leaves for the source:

• A side-by-side feature breakdown of Zenity Observe, Govern, and Defend across SaaS, cloud, and endpoint environments
• Specific limitations around homegrown agents, LangChain-style deployments, and MCP tool execution coverage
• Detailed comparison points between governance-first and attack-first approaches for agentic AI security
• Product-level descriptions of Akto Atlas and Akto Argus for teams evaluating discovery, red teaming, and runtime enforcement

👉 Akto's full post covers the platform architecture, limitations, and coverage gaps in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.