Runtime AI control outgrows assessment-only governance for agents

At a glance

What this is: Singulr AI's article argues that assessment and red teaming are not controls, because they describe AI risk without enforcing live boundaries or proving ongoing compliance.

Why it matters: IAM and security teams need to treat AI agents as governed actors in runtime, because point-in-time reviews cannot contain tool use, cross-system access, or privilege drift.

Context

AI risk governance is only useful when it changes what a system can do in production, not when it merely records exposure. In agentic environments, the gap between a score and an enforced boundary becomes operational the moment an agent can call tools, reach data, or continue acting after the assessment is complete.

This is why runtime governance matters for AI agent authorisation and identity-bound control: the question is no longer whether a model was reviewed, but whether the live system is constrained by policy at the moment of action.

Key questions

Q: What breaks when AI red teaming is not part of GenAI governance?

A: Without AI red teaming, organisations usually discover failures only after a model has already exposed data, bypassed a guardrail, or triggered an unsafe API call. The main breakdown is false confidence: teams assume standard application testing covers the model, but the real risk sits in prompt handling, tool delegation, and context-sensitive behaviour.

Q: Why do AI agents need runtime control instead of a risk score alone?

A: AI agents act across tools and services, so the key risk is what they can do at the moment of execution. A score describes exposure, but runtime control determines whether a specific request is allowed, constrained, or denied based on identity and context. Without that layer, policy remains advisory rather than operative.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.

Q: When should organisations treat AI agent authorisation as an identity problem?

A: When the system can invoke tools, move across services, or act with delegated authority, authorisation becomes an identity issue as much as a model-risk issue. At that point, the organisation must govern who or what the agent is, what it can do, and how that authority is revoked or narrowed.

Technical breakdown

Why assessment-only governance fails in live agent workflows

Assessment tools are point-in-time instruments. They can map policies, score exposure, and surface weaknesses, but they do not sit in the execution path of an AI system. In agentic environments, that matters because the risk is not just what a model could do in theory, but what an agent is doing right now across prompts, tools, data, and services. A static report cannot stop an over-scoped action, revoke a permission, or block an unsafe call after the evaluation has finished. See the AI Risk Assessment Guide.

Practical implication: Treat risk scores as inputs to control design, not as evidence that runtime governance exists.

What runtime AI control changes in practice

Runtime AI control inserts policy into the live decision path. Instead of asking whether a system is generally risky, it decides whether a specific action, request, or delegation should be allowed based on identity, context, data sensitivity, and history. That makes the governance model dynamic rather than documentary. For AI agents, the control boundary needs to follow the agent through multi-step workflows, tool calls, and cross-system actions, because the risk emerges at execution time, not only at design time.

Practical implication: Enforce permissions at the point of action, not only during review or procurement.

Why continuous proof matters for agentic AI governance

A control that cannot show whether it held over time is only partially useful. Agentic systems change state quickly, so governance has to produce evidence that the intended boundary remained in force after deployment, not just a snapshot from before launch. This is where continuous measurement and tamper-evident logging matter. They turn policy from a document into an auditable operating condition, which is especially important when autonomous or semi-autonomous systems can create, chain, or repeat actions faster than a human reviewer can intervene. See the Agentic AI Security Guide.

Practical implication: Instrument controls so you can prove enforcement after the fact, not just assert it in a policy review.

Threat narrative

Attacker objective: The objective is to use live AI workflows as an execution channel that bypasses static governance and reaches actions the organisation believed were controlled.

1. Entry occurs when an AI agent or coding assistant gains access to prompts, tools, data, or connected services that were never intended to be governed only by a static assessment.
2. Credential or authorisation misuse follows when the system retains enough privilege to invoke actions outside the intended boundary, even after a risk review has been completed.
3. Impact occurs when the agent continues to operate across systems with no runtime gate to stop unsafe actions, because the governance layer never enforced the decision it documented.

Breaches seen in the wild

• Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Assessment is now the weakest form of AI governance when an agent can act between review cycles. A score can be accurate and still be operationally irrelevant if the system can continue to use tools, reach data, or chain actions after the assessment has been filed. In agentic environments, governance must move from documentation to enforcement or it will lag the actual control plane. Practitioners should stop treating posture reports as evidence of runtime containment.

Runtime control is the missing identity layer for agentic systems. Once an AI agent can invoke services, it behaves less like a static model and more like a governed actor with a live permission boundary. That boundary has to be contextual, revocable, and tied to the request that is being made, not merely to the system that was assessed yesterday. The identity question is no longer whether the agent exists, but whether its authority is continuously constrained. Agentic AI identity becomes central here.

Red teaming is valuable, but only when it feeds an enforcement loop. Adversarial testing can expose jailbreak paths, privilege overreach, and unsafe tool use, but it does not by itself keep the weakness fixed. Organisations that stop at findings create a high-quality record of failure without changing the system’s behaviour. The discipline has to mature from exposure discovery to enforceable control design, or the same weakness will reappear in the next workflow or model refresh. The practical conclusion is simple: testing without enforcement is governance theatre.

The market is shifting from AI governance artefacts to AI governance systems. That shift changes procurement, architecture, and accountability at the same time. Teams now need to ask whether a platform can prove control at runtime, not merely produce compliance narratives or risk documentation. The organisations that get this right will define AI governance by live restriction, not by retrospective reporting. Security and IAM leaders should reframe evaluation criteria around enforceability, observability, and delegated authority.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Runtime enforcement is becoming the defining control for agentic AI. As organisations move from single-model experiments to tool-using agents, the security question shifts from what the system might do to what it can do right now. That makes policy evaluation at design time insufficient on its own; control has to be embedded where requests are authorised and executed.

Agentic AI governance will increasingly converge with identity governance. Once an agent can access SaaS, cloud, and internal workloads, the practical question is not only model safety but delegated authority, revocation, and lifecycle control. The organisations that treat AI agents as governed identities will be better positioned to contain privilege drift and to enforce task-scoped access at runtime.

Continuous proof will separate real governance from cosmetic compliance. Static reports and annual assessments will still have value, but only as inputs to a live control system that can demonstrate decisions over time. Practitioners should expect boards, auditors, and security leaders to ask for evidence that AI boundaries were enforced, not just declared.

For practitioners

• Separate assessment from enforcement in your governance model Use risk assessments and red teaming as inputs, but require a distinct runtime layer that can block, allow, or constrain live agent actions.
• Define agent permissions as task-scoped policy Set access by action, data class, tool, and context so an agent can only do what the current workflow requires.
• Instrument continuous proof of control effectiveness Capture logs, decisions, and policy outcomes that show the control held after deployment and across changing workflows. Read Zero Trust for AI Agents.
• Model agent authority as an identity governance problem Treat every agent, delegated tool chain, and connected service as a governed subject with lifecycle, approval, and revocation requirements.

Key takeaways

• AI risk assessment and red teaming are useful, but they do not stop an agent from acting outside policy in production.
• The article’s central argument is that governance only matters when it is enforced at runtime and evidenced continuously.
• For practitioners, the real shift is from documenting exposure to controlling delegated authority in live workflows.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · Agentic AI Identity Guide · Zero Trust for AI Agents · AI Coding Agents Security Guide

Key terms

• Runtime AI usage control: Runtime AI usage control is the practice of governing what an AI system can do while it is actively running. It enforces policy at the moment of action, limiting prompts, tool calls, data access, outputs, and side effects. This control helps contain misuse, reduce exposure, and keep agent behavior aligned with approved intent.
• Assessment-Only Governance: Assessment-only governance is a governance model that measures AI risk through reviews, scores, or red teaming without enforcing controls in the live system. It can identify exposure, but it does not stop unsafe behaviour, which leaves a gap between policy and production reality.
• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Continuous Proof: A governance model where trust is not treated as a one-time event but as something that must remain verifiable over time. In digital identity and certificate programmes, this means authenticity, provenance, and authorization signals must be rechecked as systems, content, and workflows change.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners turn identity and access principles into enforceable controls across AI and broader security programmes.