CSBS turns runtime authorization into the test of AI governance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on PlainID's blog post: CSBS is pushing banks toward runtime AI governance, where exam readiness depends on inventory, risk tiering, data controls and enforceable decisions in live workflows.

Why it matters: IAM, PAM and AI governance teams have to prove that policy is enforced at the point of action, not only documented for later review.

👉 Read PlainID's analysis of CSBS AI supervision and runtime authorization

Context

The governance gap is no longer whether an organisation has an AI policy. The problem is whether that policy changes what happens when an agent, model or workflow actually requests data, calls a tool or takes an action in production.

The Conference of State Bank Supervisors’ framework makes that shift explicit for financial institutions: examiners will look for scoped inventories, risk-based tiers, sensitive data safeguards and runtime controls that work inside live workflows. That means governance must be demonstrable at execution time, not just in committee notes or policy registers.

In practice, this is a control-plane problem for AI governance. Organisations need to know where AI is used, what it can touch, and how decisioning is enforced when a request crosses from design into production. AI governance becomes the coordination layer, but the decisive control remains runtime authorization.

Key questions

Q: Why do MCP-based AI workflows need runtime authorization checks?

A: They need runtime checks because the right to call a tool can change as the session evolves, the task expands, or the risk of an action rises. A one-time login does not tell you whether a later delete, export, or privilege change is still legitimate. Runtime policy keeps the decision tied to current context, not stale approval.

Q: What is the difference between AI governance and AI runtime security?

A: AI governance focuses on policies, documentation, approvals, fairness checks, and regulatory evidence. AI runtime security focuses on protecting live models, prompts, data flows, and APIs while systems are running. Both matter, but they solve different problems: governance proves control, while runtime security prevents abuse, leakage, and unsafe behavior in production.

Q: How should banks apply least privilege to AI agents?

A: Banks should treat AI agents as delegated identities with tightly scoped runtime permissions, not as broad application users. Each agent should have a named human owner, explicit tool and data entitlements, short-lived credentials, and separate production and administrative paths. Enforce zero standing privilege, step-up approval for sensitive actions, and immediate revocation when an agent changes purpose, model, or upstream data access.

Q: What evidence do auditors need for AI access decisions?

A: Auditors need a clear record of who approved each AI access decision, what policy or risk rule was applied, which identity or agent received access, and when it was granted or revoked. They also need logs showing authentication, entitlement changes, and any step-up approval or exception used. Evidence must tie the access decision to a human owner and an auditable control.

Technical breakdown

Why policy-only AI governance fails at runtime

A written policy describes intent, but it does not decide a live transaction. Runtime governance evaluates the request itself: who initiated it, what identity is acting, what data is involved, what action is being attempted and what context applies at that moment. That matters because AI workflows often move across retrieval, tool use, API calls and output generation in a single session. Without enforcement at the point of execution, the organisation is left with guidance that can be bypassed by speed, delegation or context drift. See the AI Governance Guide.

Practical implication: Shift AI governance checks from document review to transaction-time enforcement and evidence capture.

Composite identity is the real authorization unit

Agentic workflows do not present a single stable actor. The effective decision unit is the composite identity chain: the human requester, the acting agent, any delegated authority, the target resource and the requested action. This is why evaluating only the human or only the agent creates gaps. Permission must be calculated against intent and context, not just a static role, because the same agent can be safe in one task and overreaching in the next. Runtime authorization is therefore less about logging access and more about deciding whether the exact transaction is allowed now.

Practical implication: Authorise AI actions against the full identity and authority chain, not a single account or role.

Why Zero Standing Privileges changes AI workflow design

Zero Standing Privileges means access exists only when the task requires it and only for the duration of the approved action. In AI workflows, that matters because agents can touch data, tools and APIs faster than a human can intervene. If privileges are inherited or left standing, the control model assumes access persists long enough to be reviewed later, which is the wrong assumption for machine-speed execution. ZSP pushes the enforcement boundary to issuance and use, where the platform can permit, deny, mask or constrain in real time.

Practical implication: Design AI access so privileges are granted and revoked around each approved transaction, not held open by default.

NHI Mgmt Group analysis

Runtime enforcement, not policy drafting, is now the differentiator. CSBS is effectively asking whether organisations can prove that AI controls changed live system behaviour, not just governance language. That is a material shift for banks because it moves AI oversight from advisory risk framing into operational control evidence. The practitioners who win here will be the ones who can show transaction-level decisions, not policy promises.

Composite identity is the supervision unit for agentic workflows. A human or an agent in isolation is not enough to explain access decisions when AI acts inside delegated workflows. The governance question becomes whether the organisation can evaluate intent, authority, resource sensitivity and execution context as one chain. That means AI governance, IAM and PAM cannot stay separated if the workflow can move from prompt to action without interruption.

Access review assumptions break when AI acts at machine speed. Access review processes were designed for access that persists long enough to be observed, recertified and removed. That assumption fails when the actor is autonomous because request, use and release can all happen inside one runtime sequence. The implication is that governance must move from post-hoc certification to live enforcement and evidence at the moment of use.

Runtime authorization becomes the new boundary between governance and execution. CSBS is implicitly favouring controls that can stop, mask, constrain or step up a transaction while it is happening. That is where AI governance becomes testable by examiners and defensible to auditors. Organisations should treat the authorization layer as the proof point for whether their AI controls are real.

From our research library:

• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Agent Governance and Risk Guide

What this signals

Runtime control will become the audit boundary for AI programmes. As supervision matures, organisations will be expected to show that policy can alter live agent behaviour, not just describe it on paper. That creates pressure to instrument request, retrieval, tool use and output as separate decision points, with one control layer spanning them all.

AI governance will collapse into evidence engineering if the runtime layer is weak. Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. The next governance failure will be the inability to prove where an AI decision was enforced and why it was allowed.

Banks and other regulated sectors should expect supervision to push governance closer to execution, especially where agents interact with financial data or external APIs. That means the operational standard is shifting from policy adoption to provable transaction control.

For practitioners

• Map every AI use case to a live transaction path Inventory where AI requests data, invokes tools, calls APIs or produces output, then tie each step to the controlling policy and enforcement point. See the Agent Governance and Risk Guide.
• Separate policy intent from runtime decisioning Keep governance documents, approvals and risk tiering in one layer, but require the production control plane to enforce permit, deny, mask, constrain or step-up decisions in the workflow itself.
• Treat the identity chain as a single decision surface Evaluate the human requester, the acting agent, delegated authority, target resource and environmental context together so privilege does not inherit beyond the approved task.
• Build evidence from the moment of enforcement Capture policy version, requested action, decision logic, enforcement point and outcome so examiners can see what happened inside the transaction, not only what was written beforehand.

Key takeaways

• The CSBS framework turns AI governance into a test of whether controls change live system behaviour, not just whether policy exists.
• The most important design pattern is runtime authorization over the full identity chain, because AI workflows can cross data, tools and APIs in one session.
• For regulated organisations, the practical target is no longer policy alignment alone but transaction-level evidence that shows what was permitted, denied, masked or constrained.

Related NHI Mgmt Group resources: AI Governance Guide · Agent Governance and Risk Guide · ISO/IEC 42005 AI System Impact Assessment Guide · Singapore Model AI Governance Framework for Agentic AI Guide

Key terms

• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Zero Standing Privileges (ZSP): A security posture where no identity, human or non-human, holds persistent access rights. Access is provisioned dynamically on demand and automatically revoked after use. ZSP is the gold standard for NHI access control.
• Composite Identity: An identity made up of more than one control relationship, typically a human owner, an AI agent, and the credentials or services the agent uses. It matters because accountability, access scope, and runtime behaviour all have to be governed together, not as separate problems.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.

What's in the full article

PlainID's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step mapping of CSBS supervisory objectives to enforcement points in a live agentic workflow
• Concrete examples of policy versioning, immutable audit logs and step-up approval decisions
• Detailed breakdown of runtime controls for retrieval, tool selection, parameter limits and output filtering
• The vendor's walk-through of how a billing-dispute agent is controlled across seven execution steps

👉 The full PlainID post covers workflow-level control mapping, audit evidence and the billing-dispute example in detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.