Runtime governance for agentic AI is now the control problem

At a glance

What this is: JetStream Security says the central AI governance problem is runtime agent behaviour, not model correctness, because workflows can be influenced, leaked, or hijacked without real-time oversight.

Why it matters: This matters because identity, access, and audit controls for AI agents have to follow workflow execution, not just model deployment, if practitioners want trustworthy governance.

Context

The core problem here is runtime governance for agentic AI: once an agent can act across tools and data sources, traditional model-level oversight no longer tells you what the system is doing in the workflow. In practice, the missing control is not a better prompt policy but a way to see authority, provenance, and downstream reach as actions unfold.

JetStream Security frames this as a visibility gap between AI ambition and AI accountability, where the organisation can describe the model but not reliably describe the workflow. That makes governance dependent on runtime evidence, especially when the same agent can be influenced through content, manipulated through prompts, or redirected through tool output.

For teams already experimenting with zero trust for AI agents, the lesson is that control has to be evaluated at the point of action, not just at provisioning or approval time. The starting assumption that an AI system stays within its intended path is no longer safe once tools, identities, and data are involved.

Key questions

Q: What breaks when AI agents are not governed at runtime?

A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context. That is where tool chaining, MCP connections, and rapid decision-making become dangerous. Static approval cannot stop a live change in intent, so teams lose control at the point of action.

Q: Why do agentic AI systems need runtime governance instead of only pre-deployment review?

A: Because their capability set changes after deployment. New skills, connectors, memory state and permission changes alter what the agent can do, so a one-time review quickly becomes stale. Runtime governance lets teams observe actual behaviour, not just intended design, which is essential when the agent’s authority expands through ordinary use.

Q: How do security teams decide when AI access has too much blast radius?

A: Measure the sensitivity of the data involved, the number of systems the AI can reach, and whether it can take actions without a human checkpoint. If a single compromised connector or misused prompt could move confidential data across multiple systems, the blast radius is too broad for lightweight governance.

Q: What should organisations do first when they cannot fully describe an AI workflow?

A: Stop treating the workflow as governed and build a complete description of the agent, model, tools, data sources, and identities involved. If the system cannot be described, it cannot be responsibly approved, monitored, or attributed. Description is the prerequisite for any credible control model.

Technical breakdown

Why workflow-level governance matters more than model-level review

Model-level governance asks whether the model is safe to use. Workflow-level governance asks what the agent can reach, change, or disclose while executing tasks across tools and data sources. That distinction matters because agentic failure often happens in transitions, not in a single model response. A model can be well-behaved while the surrounding workflow still creates risky authority, hidden reachability, or opaque side effects. Practical implication: govern the workflow graph, not just the model artefact. Read AI Agents vs Agentic AI.

Practical implication: Review the agent’s reachable resources, tool set, and authority chain at workflow design time.

What runtime visibility has to capture in agentic systems

Runtime governance needs more than logs. It has to show which permissions were active at each step, which resources became reachable after a change, and what blast radius a proposed permission change creates before rollout. That is because an agent’s risk profile can change after a tool is added, a data source is connected, or a permission is widened. Without step-level visibility, least privilege becomes a static claim rather than an observable control. Practical implication: treat runtime reachability as a first-class governance signal. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: Track permission state, reachable resources, and change impact as part of normal governance evidence.

How MCP server trust can become a control failure

Tool hijack via compromised MCP servers is a supply path problem inside agentic execution. The agent may call the right tool but receive manipulated output, and then act on poisoned context because it cannot distinguish legitimate from tampered results. The failure is not only access to the tool, but the absence of provenance and weak session boundaries around what the tool returned. Practical implication: authentication alone does not prove tool trust if the response path is not governed. Read Threat Modelling AI Agents.

Practical implication: Validate tool provenance and session boundaries for every agent tool interaction.

Threat narrative

Attacker objective: The objective is to redirect an apparently functioning agent into disclosing data or executing actions outside its intended authority.

1. Entry begins when an agent consumes external content, prompt input, or MCP tool output that has been shaped to influence its next action.
2. Escalation occurs when the agent follows that manipulated input into broader authority, revealing more resources or moving data without a human review gate.
3. Impact follows when the workflow completes an unauthorised action path, producing data exposure, incorrect execution, or a wider blast radius than intended.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime governance is now the defining control plane for agentic AI. The central issue is no longer whether a model can answer correctly, but whether an agent can be observed, attributed, and constrained while it acts across tools and data. That changes governance from a review function into an execution-time control problem. For practitioners, the relevant question is whether authority is visible at the moment of action.

Workflow-level control exposes a named concept we should call the identity blast radius. In agentic systems, one new tool, one extra permission, or one connected data source can expand what the agent can reach in ways that are not obvious from the model alone. This is not a theoretical concern, because the article’s own examples show that small changes compound across the workflow. Practitioners should assess how far an agent can reach before any single change goes live.

Human-paced access review assumes privilege persists long enough to be reviewed. That assumption fails when an AI agent changes state across steps, tools, and data sources faster than review cycles can observe it. The implication is not just weaker oversight, but a mismatch between governance rhythm and machine execution rhythm. Organisations need to rethink whether their assurance process is built for workflows that mutate while they are still running.

Tool provenance has become an identity control, not just a platform detail. When a compromised MCP server can shape what an agent believes is legitimate output, the trust boundary has moved from the model to the tool response itself. That means the question is no longer only who can call the tool, but whether the agent can verify what came back. For practitioners, provenance belongs in the governance conversation alongside authorisation.

Shadow AI discovery must now include workflow discovery. An unmanaged agent is not just an unknown model endpoint, it is a hidden combination of tools, permissions, and data paths that may already be active inside business processes. The article’s framing makes clear that organisations can lose control before they even finish naming the workflow. Practitioners should inventory live agent paths, not just approved models.

Read next: Zero Trust for AI Agents

What this signals

Governance programmes for agentic AI are shifting from policy documents to execution evidence. If a workflow can change authority, data reach, or tool output mid-session, then the control objective is to make those changes visible before they become irreversible.

Identity blast radius: the amount of reachable data, tools, and authority an agent can accumulate as its workflow changes. Once practitioners start measuring that reachability, they will see that the real governance boundary is not the model, but the path the workflow opens around it.

The next practical step for most teams is to align agent governance with the same discipline used for privileged access: explicit description, scoped authority, and review of what becomes reachable after each change. That is the level at which agentic AI becomes governable rather than merely observable.

For practitioners

• Map every agent workflow before production use Document each agent, model, tool, data source, and identity involved in the workflow so governance starts with a real inventory rather than an assumption.
• Define permission state at each workflow step Record which permissions are active before, during, and after each action so reviewers can see where authority expands or contracts.
• Inspect reachable resources after each change Treat every new tool, data source, or permission addition as a blast-radius event and verify what becomes reachable before rollout.
• Verify tool provenance and session boundaries Require evidence that tool output is authentic and isolated from manipulated context before the agent is allowed to act on it.
• Establish discovery for unmanaged agent workflows Look for live agent activity in OAuth grants, API keys, cloud services, endpoints, and network signals when the workflow is not fully understood.

Key takeaways

• Agentic AI governance fails when teams focus on model correctness and ignore what the workflow can do with tools, data, and delegated authority.
• The article’s central evidence is that small workflow changes can compound into hidden blast radius, data exposure, or manipulated execution.
• Practitioners need runtime description, provenance, and reachability controls before they can claim meaningful oversight of AI agents.

Related NHI Mgmt Group resources: AI Agents vs Agentic AI · AI Agent Observability, Audit and Incident Response Guide · Shadow AI and AI Agent Discovery Guide · Threat Modelling AI Agents

Key terms

• Agentic AI Runtime: The execution environment that lets an AI system choose actions, call tools, and interact with external services. It includes the model, policies, credentials, logging, and enforcement layers that determine what the agent can actually do in practice.
• Workflow-Level Control: Workflow-level control is the ability to govern what an identity, human or non-human, can do within a defined business process. It applies controls at each step of a workflow, using policy, approvals, and context to limit actions, reduce misuse, and enforce least privilege across systems and handoffs.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Tool Provenance: Tool provenance is the record of where a tool came from, who approved it, and how it is allowed to act. In agentic AI and NHI governance, it links an agent’s tool, API, or plugin to verified ownership, trust level, permissions, and change history for audit and control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.