AI gateway governance now hinges on loops, verification, and harnesses

At a glance

What this is: This is a conference-led analysis of how AI engineering is shifting from model-centric work to governed loops, verification, and harness-based execution.

Why it matters: It matters because identity and access teams increasingly have to govern AI-driven execution paths, not just human users or static service accounts.

By the numbers:

• AI-generated code accounted for 27.6% of merged PRs, up from under 1% fourteen months earlier.
• Only about 48% of that AI-generated code gets explicitly reviewed before merge.
• 2026 brought together 6, ther 6,000+ engineers, 300 speakers, and 29 tracks.

👉 Read TruFoundry's analysis of AI loops, verification, and harness governance

Context

AI gateway governance is increasingly about controlling runtime decision paths, not just authenticating users or provisioning static credentials. In AI systems that loop, act, and observe repeatedly, the main question is whether the surrounding controls can bound execution, record actions, and enforce review before sensitive steps complete.

The article frames AIEWF 2026 as an annual snapshot of where the field is headed: from model talk to loopcraft, from verification gaps to harness infrastructure. That is directly relevant to NHI, agentic AI, and broader IAM governance because the access problem now includes delegated machine actions that move faster than human review cycles.

TrueFoundry uses the conference arc to argue that managed gateways, approval gates, traces, and runtime controls are the right control plane for these systems. The practical issue for identity teams is not whether AI is deployed, but whether its actions are attributable, scoped, and interruptible in time.

Key questions

Q: How should security teams govern AI loops that can take multiple actions without pausing?

A: Security teams should bound AI loops with explicit step ceilings, timeouts, and approval gates on sensitive actions. The aim is to prevent repeated execution from turning one authorised task into a broad, hard-to-review chain of side effects. Governance must happen at the runtime boundary, not after the model finishes.

Q: Why do AI agents complicate access governance more than ordinary automation?

A: AI agents complicate access governance because they can branch at runtime, wait on external services, and continue later with the same operational context. That means privilege is not just granted at launch, it persists across a live session that must be observable, resumable, and attributable.

Q: What do organisations get wrong when reviewing AI-generated work?

A: They often assume downstream human review will catch unsafe output before it matters. In practice, review lags generation, especially when machine-written code or actions scale quickly. Organisations need controls that block or validate output before it enters production workflows, not only after.

Q: How should IT teams govern identity access when AI becomes part of the operating model?

A: IT teams should treat AI-enabled workflows like any other production access path: assign a named owner, define the business purpose, scope permissions tightly, and make revocation explicit. The important shift is governance, not tooling. If AI expands what IT can do, identity controls must expand with the same discipline.

Technical breakdown

Why AI loops become a governance problem

A loop is an agent that continues taking steps until a goal or stop condition is reached. Once a system can repeatedly call tools, fetch context, and act without human re-entry, the security question shifts from single-request authorization to session-level control. That creates a larger blast radius because the same identity can accumulate actions, side effects, and state across a run. In identity terms, the problem is not just access, but the persistence of decision authority across multiple steps.

Practical implication: govern AI loops with step ceilings, budgets, and explicit stop conditions rather than relying on one-time access approval.

Verification gaps in AI-generated work

Verification becomes a distinct control layer when machine-produced output scales faster than human review capacity. The article's cited numbers show why: code generation has moved into a material share of merges while explicit review remains far lower. That means review is no longer just a quality function, it is an access-control analogue for machine output. Where verification is weak, errors and unsafe actions can pass through because the organisation assumed humans would catch them later.

Practical implication: place quality gates, traces, and reviewer ownership at the point of output rather than after deployment.

What a harness adds to agent identity governance

A harness is the surrounding execution environment that constrains how an agent plans, acts, observes, and retries. In practice it is the control layer that can impose sandboxing, approval gates, scoped credentials, and auditable logs around delegated work. For identity teams, the value is that the harness turns AI activity into something closer to governed workload behaviour than free-form automation. That makes it easier to apply lifecycle, access, and audit controls consistently across repeated runs.

Practical implication: treat the harness as the policy boundary for AI execution and align it with existing IAM and NHI governance.

Threat narrative

Attacker objective: The objective is to turn delegated AI execution into a high-speed path for unauthorized or unsafe actions that bypass normal review and accountability.

1. Entry occurs when an AI system is granted standing access to tools, codebases, or gateways and begins operating in a loop without fresh human approval. Escalation happens as the loop repeats, accumulates context, and expands its effective scope across multiple actions. Impact follows when unchecked execution produces code changes, workflow side effects, or downstream system actions that exceed what reviewers expected.
2. Attackers or unsafe actors benefit when verification lags behind generation, because machine-written actions can pass through the pipeline before human review closes the gap. The objective is to get persistent, high-speed execution accepted as normal operational behaviour. The end state is governed infrastructure being used as an unbounded action engine.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Loopcraft is now an identity governance problem, not just an engineering style. Once an AI system can chain actions across tools and sessions, the control question changes from whether access was granted to whether its authority was bounded in time. The old assumption was that identity behaves in discrete requests that humans can review later; that assumption breaks when the actor keeps deciding and acting before a reviewer ever sees the trail. Practitioners should treat looping behaviour as a governed identity pattern, not a developer preference.

Verification is becoming the new enforcement point for machine work. The article's cited review gap shows why organisations cannot rely on downstream inspection alone. If AI-generated output is already a meaningful share of production changes, then human review is no longer a universal safety net. The implication is that access governance and quality governance are converging around the same runtime checkpoint.

Harnesses are the right abstraction for delegated AI because they reintroduce control without pretending the model is passive. A harness can sandbox runs, broker credentials, and preserve traces in ways a standalone model cannot. That matters because the governance unit is no longer the user session or the service account alone, but the full plan-act-observe cycle. Identity teams should therefore evaluate AI systems as governed execution environments, not as chat interfaces with extras.

The named concept here is governance lag: the delay between AI action and human validation. Governance lag is the gap that appears when systems can take repeated actions faster than access review, approval, or audit can respond. Once that gap exists, least privilege becomes less about initial assignment and more about runtime interruption. Practitioners need to see that lag as a structural limit of traditional IAM cadence, not a training issue.

Agentic AI security is now inseparable from NHI discipline. The same control patterns that matter for service accounts, tokens, and workload identities now apply to agents that choose actions at runtime. That means lifecycle, brokered credentials, logging, and scoped delegation have to be designed together. Teams that separate AI governance from NHI governance will miss the shared failure modes and duplicate controls unnecessarily.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Another 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• For a broader framework view, see OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 for the controls most closely aligned to this governance gap.

What this signals

Governance lag is now the defining risk for AI execution. When AI systems can act faster than review and approval cycles, the gap is no longer theoretical. With 80% of organisations already reporting AI actions beyond intended scope, the operational priority is to shrink the time between action and control with runtime policy, not post-hoc inspection.

Agentic AI and NHI governance are converging at the same control point. The practical boundary is the harness, gateway, or broker that issues credentials and records activity. Identity teams should align those layers with NIST AI Risk Management Framework thinking where autonomy is present, and with workload identity discipline where it is not.

The next programme decision is whether AI actions are treated as trusted automation or as governed identity events. If they are not logged, bounded, and revocable at runtime, they are already outside modern identity assurance even if the model itself appears well behaved.

For practitioners

• Define hard stop conditions for AI loops Set explicit step ceilings, timeout rules, and budget thresholds for every delegated run so repeated execution cannot continue indefinitely. Tie the stop condition to the workflow boundary, not to a vague notion of model completion.
• Move approval gates to the action boundary Require human approval before sensitive tool calls, code merges, data access, or external side effects. A review that happens after the action is not a control for high-speed AI execution.
• Make traces part of identity evidence Preserve per-step logs, credentials used, outputs created, and retry history so that AI actions can be reconstructed during audit or incident review. Treat those traces as identity artefacts, not only observability data.
• Align harness policy with NHI governance Map each agent, gateway, and runtime privilege to an owner, expiry rule, and revocation path. If the system brokers credentials, the brokering layer needs the same governance discipline as any other non-human identity.

Key takeaways

• AI engineering is shifting from model-centric delivery to governed execution, where loops, traces, and approvals matter more than prompt quality alone.
• The scale signal is clear: AI-generated output is growing faster than human review capacity, which makes runtime controls a security requirement, not an optimisation.
• Identity programmes should treat harnesses and gateways as the policy boundary for AI systems, with explicit ownership, scoped credentials, and interruptible actions.

Key terms

• Agent Harness: The agent harness is the runtime layer that wraps a model and turns it into an acting system. It usually includes the loop, tools, context handling, permissions, hooks, and logs. In security terms, it is often the real place where privilege sits and where identity evidence must be governed.
• Governance Latency: Governance latency is the delay between a change in risk, relationship, or access need and the point at which the control model reflects that change. In API environments, high governance latency turns simple access management into a bottleneck and increases residual exposure.
• Loop: A loop is a repeated plan-act-observe cycle in which an AI system keeps working until a task is complete or a stop condition is reached. For autonomous or highly delegated systems, loops amplify both productivity and risk because each iteration can expand scope, cost, and side effects.
• Harnessed execution: Harnessed execution means delegated AI work runs inside defined operational boundaries, such as sandboxing, step limits, credential brokerage, and audit logging. This is the practical form of control for non-human and agentic identities when the organisation needs repeatable actions without unrestricted autonomy.

What's in the full article

TruFoundry's full analysis covers the operational detail this post intentionally leaves for the source:

• The documented Agent Harness flow, including managed plan-act-observe execution and approval points.
• The gateway controls that broker credentials, enforce quotas, and preserve per-step traces.
• The conference coverage and source links behind the 27.6% and 48% figures, useful for deeper validation.
• The surrounding platform documentation for loops, governance controls, and runtime observability.

👉 TruFoundry's full post covers the conference arc, platform controls, and runtime governance detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.