Guardian agents expose the oversight gap in agentic AI workflows

At a glance

What this is: DTEX’s analysis of Gartner’s first Market Guide for Guardian Agents says agentic AI has created an oversight problem that human review cannot keep up with.

Why it matters: This matters because AI agents are increasingly acting inside enterprise workflows under human identities, which forces IAM, PAM, and governance teams to treat observability, delegation, and review as runtime controls rather than after-the-fact checks.

By the numbers:

• At least 80% of unauthorized AI agent transactions through 2028 will come from internal policy violations rather than malicious attacks, according to Gartner research cited by DTEX.

Context

Agentic AI changes the governance problem because systems can act, choose tools, and move data without waiting for a human to approve every step. That makes traditional alert handling too slow for workflows where the agent can complete the risky action before the review starts.

The core issue is not only detection, but attribution and context. When an agent operates inside a human account, security teams need to understand whether the activity reflects the user, the workflow, or an autonomous decision path, which is why AI agent observability becomes a governance requirement rather than a reporting feature.

Key questions

Q: What breaks when AI agents can make code changes faster than humans can review them?

A: Manual review stops being a meaningful control if it cannot keep pace with change volume. Teams then miss unsafe dependencies, unintended privilege use, and subtle architecture drift. The failure is not only in code quality, but in the programme’s ability to detect and contain agent-driven mistakes before they reach production.

Q: Why do autonomous agents create new governance risks in enterprise workflows?

A: Autonomous agents complicate governance because they can act across systems, carry context between steps, and make decisions without a human at each hop. That increases the chance of unauthorized data access, unexpected side effects, and weak accountability. Organisations need explicit boundaries for identity, scope, and traceability so the agent’s actions remain reviewable and controllable.

Q: What are the signs that an AI agent session is drifting out of policy?

A: Look for unexpected tool calls, suspicious command sequences, credential exposure attempts, memory manipulation, or changes that exceed the user's stated objective. Those signals indicate that the agent is no longer acting within the intended task boundary. The key is to evaluate the whole sequence, not any single isolated event.

Q: How do organisations keep humans accountable when AI agents are doing more of the investigation work?

A: They need a model where agents can investigate and propose actions, but humans still own the judgment calls and the verification standards. The practical guardrail is a system that shows what the agent did, what remains pending approval, and whether the action actually worked. That preserves accountability while reducing manual toil.

Technical breakdown

Why human-style review fails for agentic workflows

Human review assumes an event happens slowly enough to be inspected after the fact. Agentic workflows break that assumption because they can chain tool use, data access, and external communication within a single session. That means the risk is not just what the agent does, but how quickly it can move from instruction to action. A second problem is that the same workflow may look normal in isolation while being anomalous in sequence. Security teams therefore need behavior-based context, not just alert volume, to understand whether an action was routine experimentation or an emerging governance failure. Read Zero Trust for AI Agents.

Practical implication: Treat review queues as insufficient unless they are paired with runtime behavioral context and action-level policy decisions.

What guardian agents actually add to oversight

A guardian agent is an oversight layer that evaluates another agent’s activity, often using policy, anomaly detection, confidence scoring, and human escalation. The architecture matters because it introduces a separate control path for evaluation, rather than expecting the acting agent to self-restrain. In the DTEX model, this also means the system must record enough evidence to explain why an action was accepted, challenged, or looped back. Without that decision trail, the control becomes opaque and hard to audit. The practical value is not autonomy for its own sake, but a structured review layer that can operate at machine speed while preserving accountability. See the Agentic AI Identity Guide.

Practical implication: Build a separate oversight path for agent decisions and require every escalation to produce an auditable rationale.

Why behavioural baselines matter more than event counts

Event counts alone do not tell you whether an AI agent is drifting from intended behaviour. Behavioural baselines compare tools used, pages visited, files touched, and data movement patterns over time, which is how a system can spot a meaningful shift rather than a noisy spike. That distinction is essential in agentic environments where a single session may contain many legitimate actions and one harmful one. The security issue is not the existence of activity, but whether the sequence matches prior patterns closely enough to be trusted. Baselines make the difference between anomaly detection and alert fatigue. See the Agentic AI Security Guide.

Practical implication: Baseline agent sequences, not just single actions, so review teams can detect drift before it becomes an incident.

Threat narrative

Attacker objective: The objective is to cause policy-breaking data movement or actions through an agentic workflow before human oversight can stop it.

1. Entry occurs when an AI agent is embedded in a normal enterprise workflow such as a copilot, IDE plugin, browser extension, or RPA task.
2. Credential and data exposure emerge when the agent operates under a human identity with access to sensitive data, untrusted content, and external communication paths.
3. Escalation happens when the agent follows the wrong instruction, moves the wrong data, or triggers the wrong action before a human reviewer can intervene.
4. Impact is unauthorized AI agent behaviour that violates enterprise policy and creates insider-risk outcomes without requiring a classic external intrusion.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Guardian agents are becoming a governance layer, not just a detection feature. The article makes clear that enterprises need a second control plane for AI systems that can act at machine speed. That shifts the question from whether an agent behaved strangely to whether its action was acceptable before execution completed. For IAM and PAM teams, the implication is that runtime evaluation must sit alongside identity issuance and entitlement review.

Agentic AI exposes the limits of human-centred identity assumptions. The article’s strongest point is that many agents operate under human identities while behaving like machine-scale actors. That breaks the normal expectation that a user account maps cleanly to one person, one intent, and one decision stream. The identity model now has to account for delegation, behavioural context, and the difference between who owns the account and who or what is using it. Agentic AI identity is becoming a core governance topic, not a niche technical extension.

Oversight must shift from post-event triage to decision-time governance. If an agent can act, communicate, and move data before a human sees the alert, then retrospective review is no longer the primary control. The article points toward a new operating model where policy, review, and explanation happen inside the workflow. Practitioners should treat this as a design change across security operations, not a bolt-on feature request.

Behavioral context is the named concept that matters here. The article shows that isolated alerts cannot explain agentic risk, because sequence and context determine whether an action is harmless or dangerous. That makes behavioural context the governance primitive for AI oversight, especially where agents are embedded in everyday business tools. Security teams should measure whether they can explain an agent’s decision path, not just log its final output.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Decision-time governance is the real control gap. AI oversight is shifting from whether teams can inspect an action later to whether they can decide safely before the action completes. That makes policy enforcement, explanation, and escalation part of the runtime architecture, not just the SOC workflow.

Identity models need to distinguish ownership from execution. Agentic systems often run under a human account while behaving like independent actors, which means access governance has to cover delegation, context, and revocation as separate questions. Teams that treat the account holder and the acting entity as the same thing will miss the point of agentic AI identity.

For practitioners

• Instrument agent activity with behavioural context Capture the sequence of tools, files, pages, and data movements around each agent action so analysts can see what happened before, during, and after a decision.
• Separate acting agents from reviewing agents Design a control path where one component performs the task and another evaluates the outcome against policy and confidence thresholds before closure.
• Map agent permissions to task scope Review whether each agent has only the access needed for the specific workflow it performs, and remove standing access that outlives the task. See the AI Agent Authorisation Guide.
• Baseline normal agent sequences Define what routine behaviour looks like for each agent class so that anomalous tool use or data movement can be compared against a real historical pattern.

Key takeaways

• AI agents create a governance gap when they act at machine speed inside workflows built for human review.
• The strongest evidence in the source is Gartner’s expectation that at least 80% of unauthorized AI agent transactions will come from internal policy violations by 2028.
• Security teams need runtime context, decision trails, and task-scoped access if they want to govern agentic behaviour effectively.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic AI Security Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Guardian agent: A guardian agent is a supervising control that monitors AI agents in real time and enforces policy as they operate. In practice, it represents a shift from passive monitoring to active oversight of identity, behaviour, and execution timing across AI workflows.
• Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
• Decision Governance: Decision governance is the practice of governing the authorization decision itself rather than only the identity record or entitlement list. It focuses on the subject, action, resource, and context that produced the result, which is especially important when agents and service accounts can act dynamically at runtime.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and workload identity for practitioners building modern access controls. It helps security and identity teams translate governance requirements into operating models they can use across real programmes.