AI security governance fails when agents outpace control planes

At a glance

What this is: Akto frames AI security governance as the control layer needed when autonomous agents, MCP tools and chained actions create risks that ordinary application security cannot see.

Why it matters: IAM, PAM and NHI teams need this lens because agent permissions, tool access and auditability now determine whether AI systems are governable at runtime.

Context

AI security governance is the structured way organisations assign accountability, set policy and enforce standards across AI systems from build to retirement. The problem is that agentic workflows do not behave like conventional applications, because they can chain tool calls, act without direct human intervention and change the security perimeter as they run.

For identity and access teams, that means the control plane must now govern AI agents as active actors rather than passive software. The article makes the intersection explicit: agent inventory, tool authorization, audit trails and runtime guardrails are all identity-adjacent governance problems, not just AI policy problems.

Key questions

Q: How should security teams govern AI agents that can choose tools at runtime?

A: Security teams should govern runtime agent choice as an access event, not as a simple application action. That means scoping permissions to the task, limiting token lifetime, logging every tool decision, and blocking the agent from reaching systems outside its approved context. Static roles alone are not enough when the execution path changes on each run.

Q: Why do agentic AI systems create greater operational risk than standalone LLMs?

A: Agentic systems create greater operational risk because a successful attack can translate into an executed action, not just a harmful response. That action may write to a database, call an external API, or modify shared state before a human can intervene. The risk is therefore operational and immediate, which means testing must evaluate what the system can do, not only what it says.

Q: What are the signs that AI governance is failing in the enterprise?

A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk. Another indicator is weak visibility into who is using which tools and what data they are sending. If teams cannot answer those questions, governance is not working as intended.

Q: What should organisations do when AI agents can access external APIs and internal systems?

A: Organisations should put non-LLM permission controls around agents, so the model can suggest an action but cannot exceed its authorised scope. They should also apply input validation, rule-based guardrails between agents, secure vendor checks for third-party APIs, and logging that tracks data flow and detects anomalies in real time.

Technical breakdown

Why agentic workflows break traditional application security

Agentic systems differ from standard applications because the same input can lead to different actions, tool calls and downstream effects. Once an LLM can call MCP-connected tools, it is no longer just producing text. It is making choices that can affect data, systems and access paths. That breaks assumptions built into conventional application security, which often focus on static functionality, bounded transactions and predictable execution. The security challenge is not only model output, but the action chain created by the model, its tools and any delegated permissions. Governance therefore has to cover the full runtime path, not only the interface exposed to users.

Practical implication: Treat every tool-enabled agent as a governed actor with explicit action boundaries and monitored tool access.

How discovery and inventory become governance controls

A governance program cannot control what it has not inventoried. In agentic environments, that inventory must include agents, models, MCP servers, connected tools, data sources and any unsanctioned integrations created by teams outside formal review. Without that visibility, organisations cannot assign risk ownership, enforce access boundaries or know which workflows need tighter monitoring. This is why discovery is not just an administrative task. It is a prerequisite for policy enforcement, because the policy surface changes as new agents and tools appear. Continuous inventory also matters because agentic environments evolve faster than annual review cycles.

Practical implication: Build a live inventory of agents, tools and data connections before trying to govern access or compliance.

Runtime guardrails are the control plane for AI actions

Runtime enforcement is the point where governance becomes operational. Input filtering can stop prompt injection from reaching the model, output filtering can reduce leakage, and access controls can constrain which tools an agent may call. But the critical shift is that the most dangerous failure happens at the point of action, not at the point of generation. If an agent can trigger a database query, send email or invoke an internal tool chain, governance must decide whether that action is allowed in real time. That makes guardrails, audit logs and posture monitoring part of the control plane, not optional add-ons.

Practical implication: Put allowlists, output filters and action logging in the runtime path so unsafe behaviour is blocked before execution.

Threat narrative

Attacker objective: The attacker wants the agent to execute unauthorized tool actions or disclose data while appearing to operate within normal workflow.

1. Entry begins when a prompt injection or unsafe integration reaches an agent that already has access to tools and data sources.
2. Credential access occurs when the agent uses delegated permissions, API access or connected tools to act on the injected instruction before a human can intervene.
3. Escalation and impact follow when chained tool calls let the agent move from a harmless-looking request to unauthorized data access, leakage or other downstream actions.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI security governance now fails at runtime, not at policy design. The article's core point is that autonomous agents create risks only visible when tool use, delegation and action timing are governed together. That shifts the security problem from model oversight to control-plane enforcement, where discovery, authorization and logging must operate continuously. Practitioners should treat runtime governance as the real boundary of AI safety.

Agent inventory is the new prerequisite for identity control. If security teams cannot enumerate agents, MCP servers, tools and data connections, they cannot assign accountability or restrict privilege. This is where agentic AI intersects directly with IAM and NHI governance: the security issue is not just what the model says, but what the agent is permitted to do. Practitioners should make inventory completeness a control objective, not a documentation exercise.

AI governance debt accumulates when teams treat agents like ordinary software. Traditional controls assume predictable execution and reviewable behaviour, but chained actions and non-deterministic outputs break that model. NIST AI RMF and ISO 42001 matter here because they frame governance as an ongoing system of accountability, measurement and management rather than a one-time review. Practitioners should align policy, monitoring and enforcement around the agent lifecycle, not deployment alone.

Runtime guardrails are becoming the decisive security layer for agentic systems. Input and output controls are necessary but insufficient if agents can still invoke tools that move data or trigger business actions. The practical lesson is that identity governance must extend into action governance, with tool authorisation, audit trails and revocation tied to the live state of the agent. Practitioners should expect governance maturity to be measured by how much risky action can be stopped before execution.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

AI governance debt: the longer organisations let agent inventory, tool approval and audit trails lag behind deployment, the more difficult it becomes to prove who or what acted at runtime. That debt is now an access problem as much as a model-risk problem, which is why governance has to move into the control plane.

Agentic AI programmes should be measured by whether risky actions can be stopped before execution, not by how many policy documents exist. The strongest control sets combine discovery, authorisation and logging with a live view of connected tools, because governance without runtime enforcement is only partially effective.

69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That is the practical signal for readers: the governance model is changing, and identity controls need to follow the agent, not just the user.

For practitioners

• Inventory every agent and tool connection Map LLMs, AI agents, MCP servers, connected tools and data sources across cloud, infrastructure and employee devices so you can see the full governance surface.
• Assign explicit ownership for AI tool access Put each agent-to-tool or agent-to-data approval into a RACI model so no engineer or product team can assume accountability by default.
• Enforce runtime allowlists and output controls Constrain which tools an agent may call, filter suspicious inputs and block sensitive output paths before the action is executed.
• Log model, tool and decision events Keep audit trails for major model interactions, tool calls and agent decisions so incidents can be reconstructed and reviewed under regulatory scrutiny.
• Trigger red teaming on workflow changes Re-test the highest-risk agentic workflows whenever prompts, tool access or model behaviour changes, rather than waiting for an annual review cycle.

Key takeaways

• Agentic AI changes governance from static policy to runtime enforcement because the real risk appears when tools, permissions and chained actions converge.
• Discovery, ownership and auditability are now foundational controls for AI security because organisations cannot govern agents they cannot inventory.
• The most effective containment point is the control plane, where tool access, action logging and approval boundaries can stop unsafe behaviour before execution.

Key terms

• API Security Governance: API security governance is the set of policies, controls, and oversight used to keep application programming interfaces safe and accountable. It defines who can create, expose, use, monitor, and retire APIs, then enforces authentication, authorization, logging, rate limits, schema validation, and lifecycle review across internal and external integrations.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• AI Audit Trail: An AI audit trail is a record of what an AI system did, when it did it, and what information influenced the result. It captures prompts, tool calls, model outputs, decisions, approvals, and changes to configuration, creating evidence for investigation, accountability, compliance, and post-incident review.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and secrets management. It helps practitioners build the control thinking needed to govern machine, workload and AI-driven access at scale.