Governing agentic AI identities requires new enterprise controls

At a glance

What this is: This whitepaper argues that agentic AI is already operating inside the enterprise and that legacy DLP and EDR controls do not govern machine-speed agent behaviour well enough.

Why it matters: IAM, PAM and NHI teams need to treat autonomous AI as a distinct identity governance problem because review, containment and audit patterns built for humans do not map cleanly to agents.

Context

Agentic AI governance is the problem of controlling software entities that make runtime decisions, select tools and act across enterprise systems without a human approving each step. That is materially different from governing conventional automation, because the identity is not simply executing a script. Cyberhaven's whitepaper places that problem in the enterprise today, not in a future planning cycle.

The security gap is not only visibility. It is the mismatch between human-paced governance controls and agent-paced execution, where actions can occur inside one session and leave little or no usable audit trail for review. For IAM and NHI programmes, the question becomes where control must shift from post-action review to pre-action authorisation and ongoing observability.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do legacy data loss prevention controls miss risk in agentic AI environments?

A: Legacy DLP misses risk because it was designed for a world where humans directly moved files and messages. AI systems now summarize, transform, and relay data on behalf of users, often across chained workflows and connected tools. Without visibility into the model session itself, security teams cannot reliably see where sensitive data enters, moves, or leaves the environment.

Q: What are the signs that AI governance is failing in the enterprise?

A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk. Another indicator is weak visibility into who is using which tools and what data they are sending. If teams cannot answer those questions, governance is not working as intended.

Q: How should teams handle AI agents that can act before humans can review each step?

A: They should move governance from post-action review to action-time control. That means every production agent needs bounded permissions, traceable tool use, and a clear owner who can explain and stop its behaviour when it changes. If the system can act independently, the control point has to exist before the action completes.

Technical breakdown

Why legacy DLP and EDR stop short for agentic AI

Data loss prevention and endpoint detection were designed to spot human-operated misuse, suspicious transfers or known hostile behaviour after the fact. Agentic AI changes the operating model because the system can read, decide and act across multiple tools and data stores at machine speed. If the control stack assumes a stable human operator, the same identity can complete several actions before a security team sees a single meaningful event. That makes output monitoring necessary but insufficient: the control problem becomes runtime governance of the agent's allowed actions, not only inspection of what left the endpoint.

Practical implication: Treat DLP and EDR as detection layers, not as the primary governance boundary for autonomous AI agents.

Why visibility, observability and control must work together

The whitepaper's three-pillar model is useful because each pillar covers a different failure mode. Visibility tells you what agents exist and where they run. Observability tells you what they actually do across sessions and systems. Controls constrain what they are allowed to reach, change or exfiltrate. None of those three is enough alone: visibility without observability hides runtime behaviour, observability without controls records harm without preventing it, and controls without lineage produce policy that cannot be investigated. In agentic environments, these pillars behave as a system, not as independent projects.

Practical implication: Design governance so inventory, runtime telemetry and access controls are implemented together rather than sequenced as separate workstreams.

Why data lineage becomes the investigation layer

Data lineage links a resource, action and destination so investigators can reconstruct how an agent moved data or triggered a downstream workflow. In an agentic environment, isolated alerts rarely tell a complete story because the agent may query, transform and route information across several systems in a single session. Lineage turns those fragments into an evidence chain that supports containment, root cause analysis and policy tuning. Without that chain, security teams know something happened but cannot reliably answer what the agent accessed, what it changed or what else may have inherited the same exposure.

Practical implication: Build lineage visibility into the controls and telemetry that govern autonomous AI access, not as a separate afterthought.

Threat narrative

Attacker objective: The objective is to use legitimate agentic access to move or manipulate data faster than enterprise governance can detect and constrain it.

1. Entry occurs when an autonomous AI agent is allowed to operate on endpoints, files, tools and data stores without human-in-the-loop approval for each action.
2. Escalation happens when the agent can chain multiple permitted actions inside one session, crossing system boundaries before a reviewer can intervene.
3. Impact follows when the behaviour produces uncontrolled data movement or policy-bypassing actions that existing human-paced controls do not contain in time.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI governance is not an extension of classic NHI hygiene: it is a different control problem because the identity decides and acts at runtime. That means the control boundary moves from periodic review to the moment of authorisation and execution. Security teams that keep treating agents as scripted workloads will miss the governance gap that defines the category.

Access review assumes privilege persists long enough to be reviewed: that assumption was designed for human and static machine identities. It fails when an agent can acquire, use and release access inside a single session or task. The implication is not merely more review activity. It is a rethink of where governance evidence is created in the first place.

Visibility, observability and controls form a single governance chain: the article's framework is strongest when those layers are managed together. A gap in one pillar compounds the others because investigators cannot prove what happened if they cannot see the actor, the behaviour and the route of movement. Practitioners should organise agentic governance as an integrated operating model, not a tool stack.

Data lineage is becoming the decisive investigation primitive: once agents can traverse files, tools and stores autonomously, alerts without lineage are operationally weak. The field needs a way to answer which action produced which downstream state, not just whether a policy fired. That shifts the identity conversation from approval alone to traceability at execution time.

Runtime authority becomes the real policy boundary: when an AI agent is allowed to choose actions inside a live session, the old assumption that policy is enforced at request time is too narrow. Governance has to recognise that the session itself can become the locus of privilege, not just the credential that started it. Practitioners should treat that as a structural change in enterprise identity design.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Runtime governance, not post-action review, is becoming the defining control model for agentic AI. As autonomous systems take on more enterprise work, the real security question shifts to where privilege is granted, how tightly it is bounded and whether the session can be traced end to end. Teams that keep relying on review cycles designed for people will find the control point has already moved.

Agentic AI governance creates a new identity backlog: the programme work is no longer limited to inventorying systems, but to proving what each agent can do, why it can do it and how its actions are evidenced. That is where NHI, PAM and lifecycle governance converge for autonomous actors. According to the 2026 Infrastructure Identity Survey, 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years.

Data lineage will separate observable systems from governable ones. Once agents move between files, tools and stores without human pacing, the only durable control evidence is the ability to reconstruct the action path. Practitioners should expect lineage, session telemetry and access boundaries to become the minimum architecture for agentic trust.

For practitioners

• Define agent runtime authority boundaries Separate what an AI agent may observe, decide and execute from what a human operator may approve after the fact. Use task-scoped permission sets that limit cross-system movement, write actions and data export paths.
• Inventory autonomous agents and their data paths Map where agents run, which tools they can call, which data stores they can touch and which downstream systems inherit their outputs. Keep the inventory tied to the business owner and the technical owner for each agent.
• Instrument lineage for high-risk agent workflows Capture source, transformation and destination data events so investigations can reconstruct the full path of an agent action. Prioritise workflows that can write, delete or externally share information.
• Treat endpoint controls as detection, not governance Use DLP and EDR to surface suspicious activity from agents, but do not rely on them as the policy boundary. Put pre-authorisation and session constraints ahead of post-event inspection.

Key takeaways

• Agentic AI is already operating across enterprise systems, and the governance problem is that legacy endpoint and data-loss controls were not built for machine-speed action.
• The core weakness is not just visibility but the lack of a complete evidence chain for what agents accessed, changed and propagated across tools and data stores.
• Security teams need to shift governance toward runtime authority, lineage and session-bounded controls before autonomous behaviour becomes normalised in production.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Runtime authority: Runtime authority is the permission an AI system has while it is actively deciding and acting, not just when it is approved. In governance terms, it is the point where access, tool use, and action scope become operational, which is why build-time review alone cannot prove safety.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Visibility, Observability, and Remediation: This is the operational chain used to manage identity risk. Visibility shows what access exists, observability shows how that access is used and governed, and remediation removes or corrects risky entitlements. Together, they turn an access review from a paperwork exercise into an enforceable control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.