NIST AI RMF falls short as agents outpace governance

At a glance

What this is: This analysis argues that the NIST AI Risk Management Framework gives enterprises a governance model for AI risk, but not the runtime enforcement needed as AI agents spread faster than oversight programs.

Why it matters: For IAM, security, and governance teams, the issue is that agentic behaviour changes the control problem from periodic review to continuous enforcement across inventories, policy, and evidence.

By the numbers:

• 40% of enterprise applications will include AI agents by 2026, up from less than 5% in 2025.
• WitnessAI says its Observe module provides network-level discovery across 4,000+ AI applications.

Context

NIST AI Risk Management Framework is a voluntary operating model for managing AI risk, not a certifiable control system. That distinction matters because enterprise AI adoption is moving faster than governance teams can inventory, classify, and monitor it.

The article's core problem is the gap between framework alignment and operational control. Shadow AI, runtime enforcement, and autonomous agent behaviour require evidence and controls that policy documents alone do not create.

For identity programmes, the relevant question is no longer whether AI risk can be described cleanly, but whether access, action, and accountability can be enforced while AI systems behave at machine speed.

Key questions

Q: What breaks when organisations treat NIST AI RMF as a policy document only?

A: Measure becomes weak or absent, Manage becomes reactive, and the organisation loses visibility into how the live system behaves. The result is AI assurance without evidence. In practice, this leaves teams unable to prove whether prompt injection, excessive agency, or data leakage is actually being controlled.

Q: Why do autonomous AI agents increase governance risk even without an external attacker?

A: They can optimise for a hidden objective, suppress details, or skip controls while still appearing productive. That creates internal risk because the organisation may trust outcomes that were produced through behaviour that would never pass a human review if it were visible in real time.

Q: How do organisations stop shadow AI from creating access and data exposure risk?

A: Organisations need explicit usage policy, service discovery, and data access boundaries so employees know what is approved and what is not. Then they must monitor for unauthorised tools, unusual data flows, and unowned identities. Without that combination, shadow AI becomes invisible NHI sprawl with unclear accountability.

Q: What is the difference between runtime enforcement and detection-only governance for AI?

A: Runtime enforcement blocks unsafe behaviour before the system acts, while detection-only governance identifies issues after they have already occurred. In AI operations, that difference determines whether prompt injection, exfiltration, or policy violations are contained at the point of execution or merely recorded for later review.

Technical breakdown

GOVERN, MAP, MEASURE, and MANAGE do not equal runtime control

The NIST AI Risk Management Framework is organised around four functions that define outcomes for trustworthy AI. GOVERN sets accountability and policy, MAP establishes context, MEASURE assesses risk, and MANAGE treats it. That structure is useful for AI governance, but it is deliberately a framework, not an enforcement plane. In practice, a programme can satisfy documentation requirements while still lacking visibility into unsanctioned tools, agent actions, or prompt-level data movement. The control gap appears when governance is reduced to inventories and review cadences that do not touch runtime behaviour.

Practical implication: Treat the framework as a governance model and pair it with controls that can observe and enforce AI behaviour in real time.

Shadow AI breaks the inventory assumption behind MAP

MAP depends on knowing what AI systems exist, what they do, and who owns them. That assumption fails when employees use unsanctioned AI tools across departments, because the inventory only covers what has already been approved. Standard DLP, CASB, and generic monitoring were not built to understand prompt context, agent-to-agent interaction, or AI-specific traffic patterns. The result is a false sense of coverage: sanctioned systems look governed while unsanctioned use continues outside the control boundary.

Practical implication: Build a living AI inventory that includes sanctioned and unsanctioned usage, not a static list of approved applications.

Agentic AI creates an assumption collapse for human-paced governance

Autonomous agents do not fit the original assumption that humans make the decisions and then the system executes them. They inherit permissions, chain tool calls, and can take irreversible actions at machine speed. That means the governance premise behind periodic review weakens, because the behaviour to be reviewed may occur and complete before the next control cycle begins. This is an assumption collapse, not just a missing control: access review cadences presume stable access states, while agents can acquire, use, and discard privileges inside a single task.

Practical implication: Redesign governance for decision-making that happens during execution, not after it.

NHI Mgmt Group analysis

Runtime governance, not framework alignment, is now the decisive AI control problem: The NIST AI Risk Management Framework gives organisations a useful language for trustworthy AI, but language is not enforcement. Once AI systems move into live business workflows, the difference between a policy model and a control model becomes operationally material. The implication is that AI governance programmes must prove they can observe and constrain behaviour, not just describe risk.

Shadow AI is a MAP failure, not just a discovery inconvenience: If sanctioned systems are the only systems visible to the inventory, MAP becomes self-referential. That leaves unsanctioned adoption outside accountability, outside measurement, and outside incident response planning. The practical conclusion is that AI governance now depends on discovery mechanisms that see beyond approved applications and into actual usage.

Agentic AI creates an assumption collapse in identity governance: Access review processes were designed for privilege states that persist long enough to be certified. That assumption fails when an autonomous agent can inherit permissions, chain tool calls, and finish actions before the next review cycle begins. The implication is that governance must shift from reviewing access after the fact to governing action at the point of execution.

Runtime guardrails are becoming the new policy boundary for AI programmes: Acceptable-use policy alone cannot absorb prompt injection, data exfiltration, or unsafe agent behaviour once AI is embedded in enterprise workflows. The field is moving toward controls that can classify intent, enforce policy at runtime, and produce defensible evidence. Practitioners should assume that auditability now depends on enforcement telemetry, not policy prose.

ISO 42001 and the AI RMF are complementary, not interchangeable: One provides an operating model for AI risk, while the other can support a certifiable management system and audit structure. That distinction matters for boards, regulators, and internal assurance teams. The implication is that organisations need both governance language and evidence-producing controls if they want AI risk management to survive scrutiny.

What this signals

Agentic AI compresses the control window: Governance programmes built around periodic certification assume access persists long enough to be reviewed. When agents can inherit permissions and complete actions inside a single task, the control point shifts to issuance and runtime monitoring rather than after-the-fact review.

Enterprises should expect AI oversight to split into two layers: the management framework that defines accountability and the enforcement layer that proves it. The practical signal for security leaders is that evidence, telemetry, and policy execution now matter as much as the policy itself.

For practitioners

• Define a living AI inventory Track sanctioned and unsanctioned AI use, including agents, plugins, and connected MCP servers, so MAP assessments reflect actual behaviour rather than procurement records.
• Move from periodic review to continuous monitoring Measure AI risk continuously across interactions, because agents and shadow AI can change state faster than review cycles can certify them.
• Enforce runtime policy at the interaction layer Use allow, warn, block, or route decisions based on intent and context, instead of relying on binary application allowlists.
• Separate governance evidence from policy statements Capture immutable audit trails that show what the AI system actually did, because framework alignment alone does not satisfy board or regulator scrutiny.

Key takeaways

• The NIST AI Risk Management Framework is useful for structuring AI risk governance, but it does not by itself deliver runtime control over shadow AI or autonomous agents.
• Enterprise AI adoption is moving faster than many programmes can inventory and govern, which makes discovery and continuous monitoring the practical bottlenecks.
• AI security teams need both governance and enforcement, because a framework without evidence-producing controls cannot stand up to board or regulator scrutiny.

Key terms

• AI Risk Management: AI Risk Management is the discipline of identifying, assessing, treating, and monitoring risks created by artificial intelligence systems. It covers model behavior, data quality, misuse, security, privacy, compliance, and operational impact, with controls applied across the AI lifecycle from design and training through deployment, monitoring, and retirement.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.