AI governance fails when enforcement stops at policy alone

At a glance

What this is: This analysis shows that AI governance is failing where organisations depend on policy and user compliance instead of technical enforcement inside the browser.

Why it matters: It matters because IAM, NHI, and AI governance teams need controls that can govern AI use, data movement, and delegated actions at the point of interaction.

By the numbers:

• 455 cybersecurity practitioners were surveyed for the 2026 Annual State of the Industry Report.
• 70% of organisations have AI security policies in place.
• 27% are still actively developing AI security policies.
• 73% of organisations have autonomous AI agent systems in use or actively in development as part of their cybersecurity strategy.

Context

AI governance breaks down when organisations assume policy alone can control how people use AI tools in live work sessions. The gap is not simply approval speed, but the mismatch between written rules and where data, prompts, and delegated actions actually happen.

The article ties that governance gap to browser-layer visibility, which is where modern work now converges. For IAM and AI governance teams, the practical issue is that controls built for perimeter enforcement or after-the-fact review do not govern the moment of use, especially when autonomous or semi-autonomous systems enter production.

Key questions

Q: What breaks when agentic AI governance stops at policy approval?

A: Approval-only governance fails because it assumes the important risk is launch-time permission, when the real exposure happens during runtime decisions. Once an agent can act, adapt, and delegate, the organisation needs controls that constrain behaviour, record actions, and prove compliance after each task, not just a green status box at sign-off.

Q: Why do autonomous agents need runtime governance instead of simple access controls?

A: Autonomous agents can turn a request into a sequence of actions without a human pausing the workflow for review. Access control alone does not show what the agent inferred, returned, or invoked next. Runtime governance is needed because the risk is created during execution, not just at login or authorization time.

Q: How can security teams tell whether AI lifecycle controls are working?

A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current. If those signals are fragmented across platforms, the programme may be documenting governance rather than enforcing it. Continuous traceability is the practical test.

Q: Why is browser visibility now central to AI risk governance?

A: Because the browser is where prompts, SaaS use, data handling, and delegated actions converge. Network and endpoint tools can miss the session details that determine whether an AI interaction is sanctioned or risky. Browser visibility turns the place of work into the place of enforcement, which is where AI governance now has to operate.

Technical breakdown

Why policy-based AI governance fails in the browser

Policy is a governance statement, not a control path. In this article's context, the browser is the execution environment where employees submit prompts, move data, and interact with SaaS applications, so enforcement has to operate at that layer if it is to shape behaviour in real time. Network filters, endpoint tooling, and offline approval workflows all miss part of the transaction because they do not see the complete user session. The result is a control model that can document intent but cannot consistently prevent misuse, leakage, or unsanctioned AI access.

Practical implication: Move enforcement to the interaction layer, not just the policy layer.

How agentic AI changes identity and access assumptions

Agentic AI changes the control problem because action is no longer limited to human users making explicit decisions. An agent can request, pass, and use access during task execution, which means identity, permissions, and data handling have to be governed as runtime behaviours rather than static entitlements. That creates a direct intersection with IAM and NHI governance, because machine-like actors are now participating in workflows that can touch sensitive data and business processes. Traditional access reviews are not enough if the meaningful decision happens before the review cycle begins.

Practical implication: Design access controls for runtime decisions, not quarterly certification.

Why browser-layer visibility is now an AI security control

Browser-layer visibility is the missing control plane for work that happens in SaaS and AI interfaces. It allows teams to see actions such as copy, paste, file transfer, prompt submission, and platform switching in context, rather than inferring risk from downstream logs. That matters because the browser is where sanctioned tools, shadow AI, and sensitive data converge. If governance cannot observe that layer, it cannot reliably distinguish approved use from policy drift, exfiltration, or unsanctioned delegation. In practice, visibility is what turns AI policy from a document into enforceable behaviour.

Practical implication: Instrument the browser if you need auditable AI governance.

Threat narrative

Attacker objective: The objective is to move sensitive information or execute risky actions through AI-enabled browser workflows without effective governance or detection.

1. Entry occurs when employees or contractors use AI tools inside ordinary browser workflows without governance controls seeing the session.
2. Credentialed access and data movement happen in the same interface, which lets prompts, file uploads, and copy-paste actions bypass outside-in monitoring.
3. Impact follows when sensitive data, unsanctioned AI use, or delegated actions escape the control boundary and become invisible to the security programme.

Breaches seen in the wild

• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Policy-only AI governance is a control illusion. Once AI use happens inside the browser, written policy depends on voluntary compliance and cannot guarantee enforcement. That means the organisation has described its intent but has not created a reliable control boundary. For practitioners, governance has to be measured by enforceable outcomes, not the existence of a policy document.

Agentic AI turns access management into runtime governance. Agents do not behave like static human accounts, so IAM models built around periodic review and stable ownership no longer describe the real risk. The governance question shifts to what the agent can do during execution, what it can delegate, and what data it can touch. Teams should treat agent permissions as living access decisions, not fixed entitlements.

Browser visibility is becoming a de facto governance plane for SaaS and AI. When the browser is the point where prompts, data, and actions converge, the control gap is no longer about detection after use but enforcement during use. This creates a named problem we would call the browser governance gap: the place where policy, telemetry, and action diverge. Practitioners should close that gap before AI usage becomes too embedded to govern retrospectively.

AI security and IAM are converging around the same failure mode. The article shows that teams prioritising AI controls, ZTNA, IAM, and compliance are responding to one shared issue: the inability to enforce access decisions where work happens. That convergence matters because AI governance is no longer a specialist overlay on top of identity. It is becoming part of identity architecture itself, especially as autonomous systems begin to participate in production workflows.

Controls must account for unmanaged and third-party devices, not just corporate endpoints. Browser-native governance matters because AI use does not stop at managed laptops, and policy gaps widen when contractors or BYOD devices enter the workflow. The practical conclusion is straightforward: if the control only works on the owned device, it does not govern the business process.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Browser governance gap: the new control problem is not whether AI exists in the enterprise, but whether security teams can enforce rules at the exact point where prompts, data, and delegated actions occur. When that layer is invisible, policy becomes advisory and the operating model drifts faster than the governance programme can correct it.

The identity implication is direct: agentic AI turns access from a static entitlement into a runtime event, which is why IAM and AI governance are starting to converge. Organisations should expect more pressure to govern device context, browser activity, and task-scoped permissions together rather than as separate controls.

For practitioners

• Implement point-of-use AI enforcement Shift AI governance from policy documents to controls that can block, log, or steer activity during the browser session where prompts and data movement occur.
• Map agent privileges to runtime tasks Review how autonomous or semi-autonomous systems receive, use, and release access during execution, then reduce standing permissions that outlive the task.
• Instrument browser-level audit trails Capture prompt submissions, copy-paste actions, file transfers, and platform switching so governance can prove what happened inside AI-enabled workflows.
• Extend controls to unmanaged devices Apply the same governance rules across managed endpoints, BYOD, and third-party machines so enforcement does not disappear when the device ownership changes.

Key takeaways

• AI governance fails when organisations stop at policy and rely on voluntary compliance instead of session-level enforcement.
• Agentic AI shifts the access problem from static entitlements to runtime decisions that traditional review cycles do not catch.
• Browser visibility is now a governance requirement because it is where prompts, data movement, and delegated actions actually happen.

Key terms

• Browser Governance: The policy and control layer that manages how credentials, sessions, extensions, downloads, and authentication challenges behave inside the browser. It turns the browser from an unmanaged endpoint into part of the identity boundary, which is increasingly necessary for SaaS and privileged web access.
• Runtime access governance: Runtime access governance is the practice of deciding and enforcing access based on current execution context rather than only on static assignment. For autonomous or semi-autonomous actors, it requires time-bound permissions, audit trails, and revocation logic that can keep up with live action.
• Point-of-access enforcement: A control pattern where identity policy is applied at the moment a request is made, before any resource is returned or action is executed. In AI systems, this is the difference between governable access and post-hoc logging, especially when humans, services, and agents can all trigger the same workflow.
• Browser-native control: Browser-native control is policy enforcement built into the browser itself rather than added only at the network or endpoint layer. It can inspect and restrict user actions where web applications, data, and AI tools are actually used, which makes it useful for unmanaged-device scenarios.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and machine identity security. It helps practitioners connect identity controls to the broader security decisions their programmes now face.