NIST AI RMF for agents exposes where continuous AI risk control fails

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Collibra's blog post: AI risk management must be continuous when autonomous actions happen in production as the NIST AI RMF applies to models and agents.

Why it matters: IAM, security, and governance teams need to treat AI agents as runtime risk actors, because controls built for periodic review do not govern action, reach, and intervention once an agent is live.

Context

AI risk management is the structured way organisations identify, measure, and control risk across an AI system's lifecycle. In this article, the primary governance problem is that agent behaviour now creates risk continuously in production, which changes how AI risk oversight has to work.

Collibra's article frames the NIST AI RMF as the most practical structure for this shift because its Govern, Map, Measure, and Manage functions are meant to be continuous. The problem is not the framework itself, but the common habit of treating it like a periodic assessment checklist rather than an operating model.

For teams governing autonomous AI agents, the relevant question is no longer whether a model passed review once. The question is whether the programme can classify agent context, observe behaviour in runtime, and intervene fast enough when the agent's action space changes the risk picture.

Key questions

Q: How should security teams implement the NIST AI RMF for agentic AI systems?

A: Start with Govern and Map, but do not stop at policy and inventory. Tie each agent to an owner, a purpose, and a bounded set of tools, then make Measure and Manage continuous with red teaming, runtime guardrails, and incident response paths. Agentic AI needs identity-aware controls because its permissions can change faster than traditional review cycles.

Q: Why do AI agents make continuous AI risk control necessary?

A: Because the risk no longer sits only in model output. It also lives in what the agent can access, which tools it can invoke, and what it can trigger during execution. A programme that only reviews the model after deployment will miss behaviour that changes the risk posture inside the session.

Q: What breaks when AI risk management is handled as a one-time assessment?

A: The programme loses sight of runtime behaviour. Agents can acquire context, act, and cascade effects faster than periodic review can observe, so the control becomes blind between checkpoints. That leaves organisations with documentation of governance but no operational control over production behaviour.

Q: How do NIST AI RMF controls differ for agents versus traditional models?

A: Traditional model controls focus on outputs, validation, and periodic review. For agents, the control boundary must include delegated actions, tool use, runtime monitoring, and the ability to stop execution when behaviour diverges. The difference is not just scale, but the fact that agents create risk through action, not only prediction.

Technical breakdown

Why agent action changes AI risk management

A model's risk is mostly in its outputs, but an agent's risk is in what it does. That means the control surface expands from prompt and response review to action space, tool use, data access, and triggered follow-on actions. In practical terms, a framework that only inspects training data or model behaviour misses the identity and privilege effects of an agent acting in production. NIST AI RMF still fits, but only if Govern, Map, Measure, and Manage are operationalised against runtime behaviour rather than lab conditions.

Practical implication: map agent permissions, tool reach, and data access as runtime controls, not just model attributes.

How Govern and Map have to work for agents

Govern is the function that assigns accountability, risk tolerance, and review cadence. Map defines what the system is for, what it can reach, who it affects, and what could go wrong. For agents, Map has to include the action space and any downstream systems the agent can invoke, because context is not only input data but also what execution paths are available. If inventory and classification stop at the model boundary, the programme has already lost sight of where risk actually emerges.

Practical implication: register agents with owners, intended use, and reachable systems before granting them production access.

Why Measure and Manage must operate in runtime

Measure is supposed to replace opinion with evidence, which means baselining behaviour, tracking deviation, and testing continuously. Manage closes the loop by applying controls and intervening when risk crosses a threshold. For agents, that intervention has to be runtime-capable, because a harmful sequence can unfold faster than a review cycle. The framework's continuity is its strongest feature here, but only if monitoring covers behaviour, not just model quality metrics.

Practical implication: monitor agent actions and data access continuously, and ensure the programme can pause or contain an agent mid-session.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI risk invalidates periodic review as a control assumption: The NIST AI RMF was designed for continuous governance, but most programmes still operationalise it as a checkpoint process. That assumption fails when an agent's risk emerges during execution rather than at model approval. The implication is that governance has to move from review cadence to runtime supervision.

Autonomous agents turn context into a live authorisation problem: Map is no longer just about data lineage or use-case description. Once an agent can invoke tools, touch systems, or trigger follow-on actions, context includes execution reach and delegated scope. Practitioners should treat the agent's action space as part of the governed object, not a side effect.

Measure without runtime intervention is not management: Measuring bias, drift, or behaviour is necessary but insufficient if the programme cannot stop an agent when thresholds are crossed. That creates a visible but uncontained risk state. The field needs to stop equating monitoring with control and start treating intervention as the proof of governance.

Runtime control gap is the deciding concept here: The article shows that AI control fails when the framework is implemented as paperwork instead of an enforced operating model. Continuous AI risk management depends on live inventory, live signals, and the ability to act while the agent is still executing. Practitioners should judge their programmes by whether they can govern behaviour in the session, not after the fact.

NIST AI RMF becomes more, not less, relevant for agents: The framework's four functions are well aligned to autonomous behaviour, but only if organisations stop translating them into static review gates. That makes the real programme question one of execution discipline, not framework selection. Teams should use the RMF to expose where their controls stop at documentation.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Runtime governance becomes the new identity boundary for AI systems: Once agents can act in production, the question is no longer whether the model is trustworthy in isolation. It is whether the organisation can see, constrain, and interrupt behaviour while the agent is still executing, which pushes governance closer to identity and authorisation controls than many AI teams expect.

Continuous control is the differentiator between policy and practice: The NIST AI RMF only delivers value when inventory, measurement, and intervention run as a live system. Programmes that rely on periodic review will keep discovering that the hard part is not writing the framework down, but making it operate at runtime.

Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey](https://nhimg.org/the-2026-infrastructure-identity-survey-state-of-ai-adoption).** That gap is a warning sign for anyone treating agent rollout as a deployment task rather than a governance redesign.

For practitioners

• Inventory every AI agent and its delegated reach Capture each agent, its owner, intended purpose, tool permissions, data sources, and downstream systems it can invoke before production access is granted.
• Treat agent action space as a governed asset Define what each agent may do at runtime, including tool selection and follow-on execution paths, so Map covers operational scope rather than only model inputs.
• Baseline agent behaviour before production Measure expected actions, data access, and deviations under normal and stressed conditions so runtime drift can be detected against a known profile.
• Build a runtime intervention path Ensure Manage includes pause, containment, or revocation steps that can interrupt an agent while it is still active, not only after the event is over.
• Tie review cadence to agent risk tier Set review frequency and approval depth according to the agent's reach, sensitivity of accessed data, and potential blast radius rather than using one standard cadence for every system.

Key takeaways

• AI agents change the risk model because they create exposure through runtime action, not just model output.
• The NIST AI RMF remains relevant, but only when Govern, Map, Measure, and Manage are run continuously.
• Practitioners need live inventory, runtime measurement, and intervention capability if they want AI governance to be effective.

Key terms

• AI Risk Management: AI Risk Management is the discipline of identifying, assessing, treating, and monitoring risks created by artificial intelligence systems. It covers model behavior, data quality, misuse, security, privacy, compliance, and operational impact, with controls applied across the AI lifecycle from design and training through deployment, monitoring, and retirement.
• Govern: The NIST AI RMF function that establishes policy, ownership, accountability, and review cadence for AI risk. For autonomous agents, Govern must operate as a live control model, because execution happens continuously and can change the risk picture between reviews.
• Map: Map is a JavaScript data structure for key value storage that keeps keys in an isolated internal table instead of the prototype chain. It treats strings such as constructor and prototype as ordinary keys. That makes it a safer choice than plain objects when lookup keys may come from untrusted or external input.
• Runtime Intervention: A control capability that can pause, constrain or stop an AI system while it is operating. It is the difference between describing a risk after the fact and changing the outcome before the agent completes an unsafe action.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or AI governance programme, it is worth exploring.