AI governance maturity is still stuck at shadow and tracked AI

At a glance

What this is: This blog post sets out a five-rung AI governance maturity model and argues that most enterprises are still on shadow or tracked AI, not governed AI.

Why it matters: It matters because IAM, IGA, and security teams need evidence-based controls for AI agents, including inventory, auditability, and request-time enforcement, before they can claim governance maturity.

👉 Read C1.ai's analysis of AI governance maturity and production control

Context

AI governance maturity is the question of whether an organisation can inventory AI agents, see what they do, and enforce policy where they act. The article argues that many enterprises confuse strategy statements and policy documents with actual production governance.

The core gap is not whether AI exists in the business. It is whether the organisation can prove control over agent activity in production, including attribution, audit logging, and safe-path enforcement. That is the difference between shadow AI, tracked AI, and governed AI.

For identity teams, the maturity problem is structural: once agents can act in production without a governed intake path or traceable audit trail, the programme has not reached operational control, even if the policy slide deck says otherwise.

Key questions

Q: What is the first sign that AI governance is still stuck at shadow or tracked AI?

A: The first sign is that you cannot reliably inventory production agents and describe what they touched in operational terms. If the organisation knows AI exists but cannot trace ownership, scope, and recent activity in a single view, it is still managing discovery rather than governance.

Q: Why does request-time policy matter more than a written AI policy?

A: Because written policy only describes intent, while request-time policy changes what an agent can actually do. If the allow or deny decision happens after the action or outside the execution path, the control cannot prevent unsafe tool use or unapproved delegation.

Q: What breaks when an organisation cannot attribute agent activity to the human originator?

A: Accountability breaks, because the organisation can see that something happened but cannot reliably connect the action to the person who initiated the chain. That weakens incident review, approvals, and governance because the runtime identity is not the same as the accountable originator.

Q: How should teams govern sanctioned AI agents and shadow AI differently?

A: Sanctioned agents can be governed through approved ownership, policy, and runtime controls, while shadow AI requires discovery first because it may not appear in standard inventories. The practical difference is that one needs enforcement and the other needs exposure reduction before governance can begin.

Technical breakdown

Shadow AI versus tracked AI: why inventory alone is not governance

Shadow AI describes agents running in production without a reliable inventory, owner, or scope map. Tracked AI adds visibility, but not enforcement: the organisation knows agents exist, yet policy sits outside the execution path and rarely changes behaviour. In identity terms, this is disclosure without control. The important distinction is that governance is not achieved by knowing an actor exists; it is achieved when the actor’s permissions, actions, and outcomes are constrained at the moment of use. Without that, the programme has discovery, not governance.

Practical implication: treat inventory as the entry point, not the finish line, and verify whether the policy path can actually block or shape agent actions at runtime.

Why request-time policy is the dividing line

Governed AI, as described in the article, depends on single intake, defaults that beat documentation, and an audit trail that captures every tool call. The technical difference is request-time enforcement, which means the system evaluates policy before the action executes rather than trying to reconstruct compliance afterwards. That matters because post-event review cannot prevent an unsafe tool call, a dangerous delegation, or an unapproved action already taken by an agent. If policy only exists in a wiki or in retrospective logging, the control is descriptive, not preventive.

Practical implication: design controls so the decision to allow, deny, or constrain an agent happens before the tool call is executed.

Attribution back to the human originator is an identity problem

The article’s attribution question is more demanding than standard service-account tracing. It asks whether an organisation can link an agent action back to the person who originated the chain, not just to a generic runtime identity. That requires a usable identity graph across human, delegated, and machine actions. If the answer stops at a service account identifier, the organisation may have logs, but it does not yet have accountability. This is especially important in blended human-plus-agent workflows, where the operational subject of the action is not the same as the accountable originator.

Practical implication: build identity linkage that preserves originator context through delegation chains, not just execution context.

NHI Mgmt Group analysis

Policy documents do not equal governed AI: The article is right to separate declared strategy from operational control. In identity programmes, many organisations mistake written intent for enforceable access policy, then discover that production behaviour is outside the governance loop. The practical conclusion is blunt: if policy is not on the path to execution, it is not governing the actor.

Shadow AI is a maturity failure, not just a discovery problem: A production agent that nobody can inventory is already outside the identity boundary. That means the issue is not only visibility but also ownership, onboarding, and lifecycle control. The field should treat uncontrolled agent sprawl as a governance defect that belongs in the same conversation as unmanaged service accounts and orphaned privileges.

Request-time enforcement is the real dividing line: The article correctly identifies the moment that matters. Mature governance is not retrospective compliance checking after tool use, but policy enforcement when the request is made. That is the point at which identity, authorisation, and action converge, and where weak programmes are exposed.

Human attribution becomes the control question once agents act on behalf of people: If an organisation cannot trace agent activity back to the human originator, accountability has already degraded. The identity model has moved beyond simple execution identity into delegated responsibility, and that requires a stronger governance chain than a runtime account alone can provide.

Runtime auditability is the named concept enterprises should be measuring: Auditability at production time, not documentation quality, is the measurable sign of governed AI. The enterprise that can answer what happened, when, and under whose originator chain is operating at a materially different maturity level than the one relying on policy prose and after-the-fact reconstruction.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Runtime governance gap: Most AI governance programmes still fail at the same seam, where inventory ends and enforcement should begin. A mature programme does not stop at naming agents, it controls what they can do at request time and preserves attribution through delegation.

Enterprises should expect auditability to become the new maturity test for AI governance. If teams cannot answer what an agent did, who initiated it, and under which policy decision it ran, the governance model is still compensating after the fact rather than controlling the system in motion.

For practitioners

• Define a production agent inventory Create a live inventory of all AI agents in production, including owner, purpose, data touched, and execution boundary, so shadow AI can be distinguished from governed deployments.
• Move policy into the request path Require policy checks before tool execution, not in a wiki or after-the-fact review, so the allow or deny decision happens at the moment of action.
• Preserve originator attribution Link each agent action back to the originating human, workflow, or delegated approval chain so incident review and accountability do not stop at a service account.
• Measure safe-path friction Compare how long it takes to use the governed path versus an unsafe workaround such as downloading credentials locally, then remove the shortcut that makes bypass easier.

Key takeaways

• AI governance maturity is defined by operational control, not by the existence of strategy documents or policy statements.
• The biggest gap is the move from tracking agents to enforcing policy at the moment they request an action.
• If an organisation cannot trace activity back to the human originator, its accountability model is not ready for production AI.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Tracked AI: AI that is known to exist and appears in an inventory, but is not yet controlled at the point of action. The organisation can list the agent, yet policy remains documentary rather than enforceable in production.
• Governed AI access: Governed AI access is the approved use of AI services through defined identities, policy, and logging. It gives security and compliance teams a reviewable path for who may use which tools, what data they may submit, and how the resulting interactions are retained and monitored.
• Human Originator: The person who initiated or approved the chain of action that an AI agent later executed. For governance purposes, this is distinct from the runtime identity and is essential for accountability, incident review, and delegated authority tracing.

What's in the full article

C1.ai's full blog post covers the diagnostic model this summary intentionally leaves at a higher level:

• The five-rung maturity ladder used to classify shadow, tracked, governed, federated, and compounding AI.
• The four diagnostic questions that separate policy theatre from operational governance.
• The practical meaning of one-query auditability for agents and delegation chains.
• The executive discussion format recommended for honest maturity assessment and roadmap setting.

👉 C1.ai's full post explains the maturity ladder, diagnostic questions, and governance gaps in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.