Runtime governance for agentic AI needs a shared control model

At a glance

What this is: This is an analysis of why runtime governance is emerging as a core control layer for agentic AI, and how the AARM specification tries to standardise action-level enforcement.

Why it matters: It matters because identity and access teams will need to govern AI agents at the point of action, not just at provisioning time, and that changes how authorisation, auditability, and escalation are designed.

By the numbers:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, making over-privileged systems 4.5x more likely to experience a security incident.

👉 Read Noma Security's analysis of CSA AARM and runtime governance for agentic AI

Context

Agentic AI governance is the set of controls that determine what an AI system may do, when it may do it, and how those decisions are checked at runtime. The article argues that existing identity and authorisation models were built for more deterministic systems and do not fully address machine-speed, context-dependent action selection.

In the article’s framing, the key gap is not upstream model safety alone but the point where an agent attempts to act in the real world. That makes runtime governance relevant to identity teams, because the security question becomes whether an agent can be authorised, constrained, escalated, and audited as a distinct runtime actor.

For practitioners, this is a familiar governance problem expressed in a new form. The source argues that open, interoperable specifications matter because fragmented proprietary approaches will make agent oversight harder to standardise across tools, workflows, and vendors.

Key questions

Q: How should security teams govern AI agents that can change behaviour at runtime?

A: Security teams should govern AI agents with runtime monitoring, behavioural baselines, and identity-triggered response, not just static approval workflows. The goal is to detect when an agent drifts from expected purpose, reduce privileges immediately, and keep accountability tied to a named owner. In agentic environments, governance must work at machine speed rather than review cadence speed.

Q: Why do AI agents make non-human identity governance harder?

A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials. That increases the number of access paths security teams must supervise. The result is a stronger need for task-scoped access, explicit ownership, and continuous monitoring of what the agent can reach.

Q: What do organisations get wrong about AI agent authorisation?

A: They often treat agent access as a tooling problem instead of an identity problem. If an agent can obtain credentials, call tools, and keep working without clear token scope and revocation, the environment inherits machine identity risk. Agent authorisation should be explicit, short-lived, and auditable, especially when MCP is involved.

Q: How do teams know if runtime governance for agents is working?

A: Look for evidence that sensitive actions are being intercepted, evaluated, and either approved, modified, deferred, or denied before execution. You should also see tamper-evident receipts, consistent telemetry into SIEM and SOAR, and a clear reduction in unsafe autonomous actions crossing policy boundaries.

Technical breakdown

What runtime action governance means for agentic AI

Runtime action governance is the control layer that evaluates an agent’s proposed action immediately before execution. In the article’s model, the system does not trust the model output on its own. It intercepts tool calls, accumulates session context, evaluates the action against policy and intent, and then either allows, denies, modifies, escalates, or defers. That is materially different from upstream model filtering, because the control is applied at the moment consequence is about to occur. For identity teams, this looks like contextual authorisation applied to a software actor that can change its next step based on intermediate results.

Practical implication: treat agent action as an authorisation event, not just a logged workflow step.

Why the action boundary matters more than the model boundary

The article’s central technical point is that the real trust boundary sits at the action boundary, not inside the model. Large language models mix trusted and untrusted inputs in the same context window, which means the system cannot reliably preserve security boundaries the way deterministic software can. That is why prompt injection, confused deputy behaviour, and intent drift become runtime problems. Once the agent can chain tools, delegate to sub-agents, or continue under manipulated context, the question is no longer what the model generated but what external action it was allowed to trigger.

Practical implication: place enforcement outside the model and evaluate every high-consequence action before it executes.

How open specifications reduce fragmentation in agent governance

AARM is presented as an open specification rather than a product, which matters because the market is still early and definitions are not stable. The article argues that open conformance requirements can create a shared baseline for runtime governance before every vendor invents its own interpretation. The architecture includes mediation, context accumulation, policy evaluation, approval handling, receipts, and telemetry export, giving practitioners a vocabulary for comparing control coverage across environments. That is the same maturation pattern identity leaders saw with federation and shared telemetry standards in earlier eras.

Practical implication: evaluate agent governance tools against a shared runtime control model, not just feature claims.

Threat narrative

Attacker objective: The attacker seeks to convert manipulated context into authorised-looking machine-speed action that creates business impact before the misuse is recognised.

1. Entry occurs when the agent receives trusted and untrusted inputs in the same context window and begins acting on manipulated intent or poisoned retrieval data.
2. Escalation happens when the agent chains tools, invokes sub-agents, or continues execution under formally authorised but contextually unsafe permissions.
3. Impact follows when those chained actions produce exfiltration, privilege misuse, fraud, or unintended operational change before a human can intervene.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime governance is becoming the missing control plane for agentic AI. Upstream model safety, data protection, and orchestration hardening remain necessary, but they do not answer the question of what an agent is allowed to do at the moment of action. The article is right to position the action boundary as the point where AI becomes operational risk. For identity programmes, this means the control problem shifts from access granted at setup to authorisation enforced at runtime, which is a different governance model entirely.

Traditional authorisation assumes a stable requestor and a predictable action path. That assumption was designed for systems where the actor’s intent is known before execution begins. It fails when the actor is autonomous because the agent can chain tools, invoke sub-agents, and alter its plan mid-session. The implication is not simply that more controls are needed. It is that access reviews and static approval models stop describing the actual risk surface once runtime decision-making becomes independent.

Policy-only governance will be too weak for mixed agent environments. The article’s distinction between network, code, host, and policy-only enforcement is the right way to think about bypass resistance and context richness. Enterprises will not run one uniform agent model, so governance must account for self-hosted systems, third-party SaaS agents, and delegated workflows with different control depths. Practitioners should expect the market to converge on layered enforcement, not a single universal pattern.

Open specifications will matter more than brand-led control narratives. The article’s central market signal is that runtime governance needs conformance, interoperability, and auditability before the ecosystem fragments. Identity teams have seen this before in federation and telemetry, where proprietary divergence made security operations slower and more expensive. The same pattern is now emerging for agentic AI, and the organisations that align early to open runtime controls will have a better path to consistent governance across tools and vendors.

Action receipts will become a governance artifact, not just a logging feature. The receipt concept in AARM matters because agentic systems need evidence of what was attempted, approved, modified, or blocked at runtime. That is especially important where human approval, deferral, or escalation is part of the control path. For practitioners, the key insight is that auditability is moving from after-the-fact investigation toward first-class runtime evidence.

From our research:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
• With 70% of organisations granting AI systems more access than they would give a human employee doing the same job, the access model itself is already out of sync with current practice.
• For a practical governance baseline, see OWASP Top 10 for Agentic Applications 2026 for runtime threat patterns that should shape control design.

What this signals

Runtime governance will become a programme design issue, not an optional control add-on. With 69% of security leaders already saying identity management must fundamentally shift for agentic AI, teams should expect AI governance to move into the same planning cycle as IAM and PAM rather than remain a specialist side effort. The organisations that separate upstream model controls from runtime authorisation will have a clearer operating model for review, escalation, and audit.

Action receipts will matter as much as access logs. In practice, teams will need evidence that an agent’s proposed action was evaluated, not just that the agent had access to the tool. That shifts attention toward telemetry quality, policy traceability, and incident reconstruction, especially where the same identity can perform multiple chained actions within one session.

Least privilege is no longer a static provisioning question. The operational signal to watch is whether your current identity programme can still express policy at machine speed without relying on human-paced approvals. If it cannot, runtime governance and agent-specific conformance checks become immediate priorities.

For practitioners

• Define the agent action boundary Map which AI-driven actions count as security-relevant events in your environment, then require policy evaluation before execution rather than after the fact.
• Separate upstream controls from runtime controls Keep prompt security, retrieval protection, and orchestration hardening in place, but add a distinct runtime enforcement layer for tool use, escalation, and deferral.
• Classify agent pathways by enforcement depth Differentiate self-hosted agents, SaaS agents, and delegated workflows so you can choose network, code, host, or policy-only controls where they actually fit.
• Require tamper-evident action receipts Capture the action, the decision, the identity chain, and the outcome in a format your SIEM and SOAR can consume for review and incident reconstruction.

Key takeaways

• Agentic AI creates a runtime authorisation problem that static access models do not fully solve.
• The biggest governance risk is not model output alone but the actions an agent is allowed to execute once context changes.
• Enterprises will need interoperable runtime controls, action receipts, and escalation paths to govern autonomous systems consistently.

Key terms

• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Action Boundary: The action boundary is the point where a user or system turns a request into a business-impacting decision, such as a payment approval or access grant. It is the most important place to add controls when attackers are using legitimate-looking messages to redirect trusted workflows.
• Action Receipt: An action receipt is tamper-evident evidence showing what an agent tried to do, what identity chain was involved, what policy decision was made, and what outcome followed. It is more than logging because it supports accountability, investigation, and control verification.

What's in the full article

Noma Security's full post covers the operational detail this analysis intentionally leaves for the source:

• The full AARM component model and how action mediation, context accumulation, and deferral are intended to work together.
• The threat categories the specification is designed to address, including prompt injection, confused deputy behaviour, and intent drift.
• The implementation options for different environments, including network, code, host, and policy-only enforcement paths.
• The governance implications of joining the CSAAI Foundation under vendor-neutral oversight.

👉 The full Noma Security post covers the AARM control model, threat scope, and implementation trade-offs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.