ARISE shifts AI agent governance from visibility to runtime enforcement

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Aizome's blog post: SACR’s ARISE framing puts runtime identity enforcement, intent capture, and chain-level accountability at the centre of enterprise AI agent governance.

Why it matters: IAM and security teams need to distinguish inventory from enforcement, because agent identity controls only matter when they can stop, narrow, or trace an action before impact.

Context

SACR’s ARISE research sits at the point where agent governance stops being a visibility exercise and becomes an execution control problem. In practical terms, the question is no longer whether an AI agent exists in the environment, but whether its actions can be judged against intent while the action is still in flight.

That matters because current identity models assume that authorization is stable enough to be reviewed after the fact. Agentic AI identity only becomes governable when discovery, intent, and enforcement are treated as separate layers rather than a single inventory problem.

Key questions

Q: How should security teams discover AI agents that were never formally deployed?

A: Use identity and telemetry correlation to look for agents that authenticate, retrieve secrets, assume roles, or call APIs without a matching onboarding record. The goal is to identify active non-human identities before they become blind spots in governance. Every discovered agent should be assigned an owner, a scope, and a review path.

Q: When does runtime enforcement matter more than static permissions for AI agents?

A: Runtime enforcement matters whenever an agent can make contextual tool calls or change behavior after provisioning. Static permissions tell you what the agent could do in theory, but runtime policy tells you whether it should do it now. That is essential when the task changes, the context shifts, or privileges drift beyond the original scope.

Q: Why do multi-agent workflows increase access control risk in production systems?

A: Multi-agent workflows increase risk because one request can fan out into many actions across tools, systems, and sub-agents before a human reviews the outcome. That creates more opportunities for policy drift, excessive privilege, and unauthorized access if identity context is not checked on every step. The main control is to bind each action to the correct user identity and permission set.

Q: What should an AI agent audit trail include?

A: An audit trail should include who initiated the session, which agent executed it, what the agent was authorised to do, the exact tool calls made, the results returned, and whether a human approved the action. It should also preserve the delegation chain and time-bounded session context so the record is useful for incident response and compliance review.

Technical breakdown

Why runtime enforcement is different from monitoring

Runtime enforcement sits in the request path and can allow, block, redact, pause, or narrow an AI agent action before the system completes it. Monitoring records what happened and can only explain it afterwards. The difference matters because agent decisions can be fast, chained, and context-sensitive, so post-hoc review cannot reliably contain blast radius. In governance terms, this is the difference between observing access and governing execution. When a platform only inspects logs, it can describe policy drift but cannot stop the action that causes it. Read Zero Trust for AI Agents.

Practical implication: Treat any control that cannot intervene before completion as monitoring, not enforcement.

How intent becomes a machine-readable authorization baseline

Organizational intent is the structured definition of what an AI agent is allowed to do, what systems it may touch, and what kinds of actions are in scope. That baseline is stronger than plain permissions because permissions often exceed the original business purpose. If intent is left as natural language, model interpretation introduces drift and ambiguity at the exact point where enforcement needs deterministic rules. The architectural problem is not just who approved the agent, but whether the approval can be represented in a form a control plane can evaluate repeatedly and consistently. See the Agentic AI Identity Guide.

Practical implication: Require a structured intent model that enforcement can read without human interpretation.

Cross-chain authorization integrity in multi-agent workflows

Multi-agent systems create delegation chains where a supervisor, worker, and sub-agent can each contribute to a single outcome. The security problem is that scope can expand as an action moves across hops unless the original authorization context travels with it. This is not the same as individual-agent governance. A system may govern each agent separately and still lose control of the chain. The architectural requirement is traceability from the final action back to the originating authorization, with scope only narrowing as delegation continues. See the Multi-Agent and A2A Security Guide.

Practical implication: Trace authorization across every hop, not just at the first agent boundary.

Threat narrative

Attacker objective: The objective is to use legitimate AI agent access to produce unauthorized outcomes while preserving the appearance of policy-compliant activity.

1. Entry occurs when an employee-built or SaaS-enabled AI agent appears inside an enterprise workflow without explicit registration.
2. Credential or action scope is then exercised through legitimate tool calls, API requests, and data access that exceed the original business intent.
3. Escalation happens when the agent chain expands delegated scope across supervisor, worker, and sub-agent hops without a control that can stop the action in path.
4. Impact is the compounded blast radius of actions that were permitted in isolation but inconsistent with the originating authorization context.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ARISE is really a runtime governance pattern, not a category label. SACR’s framing matters because it separates discovery, intent capture, and inline enforcement into different architectural layers. That separation is the only way to evaluate whether an AI agent is doing what it was authorised to do at the moment it acts, not after the fact. Buyers that treat the label as the product category will misread inventory as control; practitioners should evaluate the enforcement path, not the taxonomy.

Organizational intent becomes the new governing primitive for AI agents. Permissions alone are too blunt when agents routinely hold access broader than their purpose. The useful control question is whether the organisation can state, in a machine-readable way, what the agent is for, what it may touch, and what it must not do. That is a governance shift from identity records to executable policy, and it changes how access should be approved, reviewed, and retired.

Access review processes assume access persists long enough to be reviewed. That assumption was designed for stable identities and scheduled governance cycles. It fails when an AI agent can acquire, combine, and release authority inside a single workflow step because the review artefact never exists at the right time. The implication is not a better review cadence; it is a rethink of where governance lives in the execution path.

Cross-chain authorization integrity is the missing control plane for multi-agent work. A supervisor that delegates to a worker and then to a sub-agent can turn one business request into several technical decisions. If the original human authorization does not survive the chain, accountability fragments even when every component looks individually approved. Practitioners should treat delegation as a chain-of-custody problem for authority, not just an access-management problem.

Incident-ready accountability is now part of agent governance, not an afterthought. A usable audit trail must show what the agent did, what it believed it was authorised to do, and whether that matched the intent baseline at the time. That is the difference between reconstructing an event and proving control. In regulated environments, evidence that cannot answer that question is operationally incomplete.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Zero Trust for AI Agents

What this signals

Intent drift becomes the operational warning signal. As AI agents evolve through workflow changes, model updates, and accumulated small decisions, the useful governance question shifts from whether they were approved to whether they are still operating inside the approved intent. Teams should expect their first failures to show up as scope creep, not as a clean policy breach.

Runtime governance will become the baseline expectation for agentic systems. Agent programmes that rely on registration, periodic review, and generic permissions will keep exposing a gap between what was authorised and what was executed. The practical response is to move governance closer to the action itself, with controls that can enforce policy at decision time.

For practitioners

• Define machine-readable intent baselines Specify authorised systems, data types, and action scope in structured policy so runtime enforcement can evaluate behaviour without model interpretation.
• Place enforcement in the execution path Use controls that can allow, block, redact, pause, or narrow an agent action before completion, not just after logging.
• Track delegation across agent chains Preserve the originating authorization context across supervisor, worker, and sub-agent hops so scope cannot expand silently.
• Instrument discovery beyond registration Correlate signals from identity providers, SaaS platforms, enterprise browsers, and endpoint tooling to find agents that were never formally registered.
• Test incident evidence before deployment Verify that the audit trail can show intent, action, and authorization lineage clearly enough for SIEM ingestion and review.

Key takeaways

• The core problem is not agent discovery but whether a control can evaluate and constrain an agent action while it is happening.
• SACR’s framing makes intent, inline enforcement, and chain-level accountability the main architectural issues for enterprise AI governance.
• Programmes built around review after execution will miss the shortest and most damaging AI agent failures.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Zero Trust for AI Agents · Multi-Agent and A2A Security Guide · Shadow AI and AI Agent Discovery Guide

Key terms

• Agentic Runtime Identity Security Enforcement: Agentic Runtime Identity Security Enforcement is the control of who or what an AI agent can do while it is actively running. It applies identity checks, policy decisions, and permission limits at execution time, so agent actions, tool calls, and data access are continuously constrained by authenticated identity, context, and approved scope.
• Organizational Intent: Organisational intent is the purpose, objective, or policy goal that a human owner wants an AI agent or automated system to pursue. It is translated into runtime instructions, permissions, guardrails, and approval rules so the system can act within a defined scope and be held to account.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Cross-Chain Authorization: Cross-chain authorisation is permission granted for a system or wallet on one blockchain to act on assets or contracts on another blockchain. It usually relies on bridging contracts, signed messages, or delegated approvals that let one chain recognise authority from another, so the scope, revocation, and trust assumptions must be tightly controlled.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.