Enterprise AI security governance needs identity and runtime controls

At a glance

What this is: Pluto Security frames enterprise AI security as a governance discipline spanning AI-generated code, agent permissions, embedded AI services, and model-data controls.

Why it matters: For IAM and security teams, the article shows why AI governance now depends on identity, scoped access, logging, and continuous review rather than policy alone.

By the numbers:

• Pluto Security is out of stealth with $42 million in total funding.

Context

Enterprise AI security is the governance problem that emerges when AI starts writing code, calling APIs, and taking actions inside business systems. The control challenge is no longer limited to model safety or content filtering, because the same workflows now touch application logic, identities, data, and operational decision points.

The article treats this as a scaling problem, not an experimentation problem: teams are already using AI in production contexts without matching oversight. That creates a familiar identity security pattern, where delegated access expands faster than inventory, review, and accountability can keep up.

Key questions

Q: How should security teams govern AI-enabled workflows that can act on their own?

A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.

Q: Why do AI model changes create governance risk even when approvals are still current?

A: Because approval often attaches to a declared model, not to the live service that users actually hit. If the provider swaps the model, hosting location, or upstream dependency, the organisation may inherit a new risk profile without a new review. That is why governance has to track operational identity, not just procurement records.

Q: What are the signs that shadow AI agents are escaping discovery controls?

A: Common signs include identity traces without formal registration, endpoint-level activity from local agents or MCP servers, and broad permissions with no clear owner. When those signals show up across SaaS, IDP, and EDR data but never appear in the central catalogue, discovery is failing. The symptom is fragmentation between where the agent acts and where governance can see it.

Q: How can organisations balance AI productivity with identity security?

A: Organisations can balance AI productivity with identity security by making secure access the easiest path, not the exception path. That means using governed access workflows, limiting credential visibility, and designing controls that work at machine speed. If the process is too manual, users bypass it; if it is too open, secrets proliferate.

Technical breakdown

AI-generated code and the governance gap in DevSecOps

AI-generated code changes the review model because it can enter production faster than teams can inspect it, label it, or trace its provenance. The issue is not only quality; it is that generated code may embed insecure authentication flows, bypass validation logic, or import vulnerable dependencies that security teams never associated with human authorship. In practice, this means code governance has to extend to how code is produced, not just where it is deployed. When AI creates logic, the organisation still owns the outcome, including the access paths and data exposure it introduces. See the AI Security Platform Buyer's Guide.

Practical implication: Treat generated code as a governed software supply chain input, not as exempt output.

Why AI agents need dedicated identities and scoped privileges

AI agents are not conventional scripts. They can decide when to act, which tools to call, and how to chain tasks across enterprise systems. That makes inherited user credentials dangerous because the agent may operate far beyond the human context that launched it. A safer pattern is to assign each agent a dedicated service identity, constrain it with scoped tokens, and log every action it initiates. This is where identity governance becomes central, because the question is not only what the agent can access, but what it can do autonomously once access is granted. See the AI Agent Identity Security Buyer's Guide.

Practical implication: Bind every agent to its own identity and privilege boundary, then monitor each action path.

Prompt sprawl, embedded context, and data leakage pathways

Prompt sprawl is the reuse of prompts across teams, tools, and environments without central control. That becomes risky when prompts contain internal architecture details, customer identifiers, or even API keys embedded in instructions. Once that context is copied into other systems, the exposure is no longer limited to a single model interaction. The governance problem extends to storage, reuse, retrieval, and versioning of prompts and embeddings. In other words, the prompt becomes part of the control surface, and its handling needs the same discipline normally applied to sensitive configuration or secrets. See the Generative AI Data Loss Prevention Guide.

Practical implication: Inventory prompt repositories and treat embedded context as governed sensitive data.

Threat narrative

Attacker objective: The attacker or misuser aims to turn trusted AI workflows into a path for data exposure, privilege misuse, or unauthorised business actions.

1. Entry occurs when shadow AI, reused prompts, or AI-generated artefacts enter enterprise workflows without central oversight.
2. Credential or access abuse follows when agents, prompts, or generated code carry sensitive context, broad credentials, or unreviewed API access into production systems.
3. Escalation and impact occur when those systems execute workflows, expose data, or change behaviour faster than governance can detect or constrain the outcome.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.
• 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Enterprise AI security is becoming an identity governance problem before it becomes an AI governance problem. Once agents can call systems, trigger workflows, and act on behalf of users, the core question is who or what is authorized to do the work. That shifts the centre of gravity from model quality to identity, privilege, and accountability. Practitioners should treat AI systems as governed actors, not just analytical tools.

Shadow AI creates a hidden control plane that traditional inventories do not see. The article correctly points to unmanaged tools, prompts, and embedded services as the place where governance fails first. The deeper issue is that teams cannot enforce policy on assets they have not inventoried, which is why discoverability is now a prerequisite for control. Without that visibility, even strong policy language is mostly aspirational.

AI-generated artefacts create governance debt when review processes still assume human authorship. That is the wrong operating model for code, prompts, and agent instructions that can change at machine speed. The enterprise now needs review gates that follow the artefact, not the team name attached to it. This is where AI security platform evaluation becomes relevant for security leaders choosing tooling and process.

Agent identity and privilege abuse is the clearest failure mode in this article. If an agent inherits broad user credentials, the organisation loses the ability to distinguish human intent from machine execution. That undermines least privilege, auditability, and containment. The practitioner conclusion is simple: if the agent can act independently, it needs its own lifecycle, its own boundaries, and its own oversight model.

The market is moving from AI safety language to operational control language. That matters because governance teams will be judged less on policy statements and more on whether they can inventory, constrain, and monitor live AI systems. The discipline is maturing into a control architecture problem, not a communications problem. Practitioners should expect procurement, security architecture, and audit teams to converge on the same evidence set.

From our research library:

• Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.

What this signals

AI governance is converging with identity governance. The practical implication is that agent registration, permission scoping, and revocation now matter as much as model risk reviews. If an AI system can touch business systems, the programme needs controls that look more like identity lifecycle management than traditional model oversight.

Shadow AI is a discovery problem before it is a policy problem. Teams cannot govern what they cannot inventory, which means the first control is visibility across AI-built applications, prompt stores, and embedded services. Once that asset map exists, security leaders can start applying agent identity security controls to the systems that matter most.

AI-generated code and prompt sprawl are creating a new category of governance debt. The issue is not only whether the output is safe today, but whether the organisation can later explain who authorized it, what data it touched, and how long it remained in circulation. Practitioners should expect this to reshape SDLC controls, audit evidence, and exception handling.

For practitioners

• Build a central AI asset inventory Catalog AI-built applications, agents, model integrations, prompt repositories, and embedding stores so governance starts from known assets, not assumptions. See the Enterprise AI Copilot Security Guide.
• Separate agent identities from human identities Assign dedicated service identities to each agent, scope their tokens tightly, and prevent inheritance of broad user credentials.
• Insert mandatory review gates for AI-generated code Require security review for generated logic, dependency scanning for generated artefacts, and secure baselines before deployment.
• Govern prompt storage and retrieval as sensitive data Track where prompts are stored, reused, and retrieved, and block the inclusion of internal architecture details, customer identifiers, and embedded secrets. See the Generative AI Data Loss Prevention Guide.
• Monitor runtime behaviour for drift and abuse Watch for unexpected API calls, data access anomalies, prompt override attempts, and sudden shifts in output distribution so governance can react to real behaviour.

Key takeaways

• Enterprise AI governance now reaches beyond model review into code, prompts, agents, and embedded services.
• The article’s central risk is unreviewed automation operating with delegated access and hidden data paths.
• Security teams need inventory, scoped identities, runtime monitoring, and policy architecture to keep AI deployment governable.

Related NHI Mgmt Group resources: Enterprise AI Copilot Security Guide · AI Agent Identity Security Buyer's Guide · Generative AI Data Loss Prevention Guide · AI Security Platform Buyer's Guide

Key terms

• Enterprise AI security: The discipline of protecting AI systems in production, including models, agents, connected data, and tool integrations. It combines identity control, runtime enforcement, monitoring, and response so the system cannot be trusted merely because it was approved once.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• AI Agent Identity: The digital identity used by an autonomous AI agent to authenticate to external systems, APIs, and services. Managing AI agent identities is an emerging and rapidly evolving area of NHI security.
• State Sprawl: State sprawl is the uncontrolled growth of context across users, products, tasks, and agent threads. It makes AI systems harder to govern because stale or unrelated context can influence tool selection, response quality, and follow-up actions, especially in assistants that handle multiple workflows.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity teams apply consistent controls to AI agents and other non-human identities.