TL;DR: The trust problem is no longer whether AI can act, but whether governance, permissions, and audit trails can constrain what those agents touch, according to Serval research. Serval says its acquisition of software supply chain startup Ensignia will put founder Sam Stewart in charge of security as the company expands AI agents deeper into sensitive enterprise workflows, including detection and response, application security, and infrastructure security.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Serval's announcement: Serval is folding software supply chain security leadership into its security function as AI agents expand into sensitive enterprise workflows, making guardrails, permissions, and audit trails the governing issue.
Why it matters: This matters because practitioners now have to govern AI agents as systems that can touch credentials, endpoints, and other sensitive controls, not just as workflow accelerators.
By the numbers:
- Serval raised a $75 million Series B led by Sequoia Capital in December 2025.
Context
Enterprise AI automation changes the identity problem because the system is no longer only recommending actions, it is acting across systems that already carry privileged access. When automation reaches employee access, credentials, endpoints, and support workflows, the governance question becomes whether those actions are bounded, attributable, and revocable.
Serval's move pairs a security appointment with a broader shift in operating model: the company says AI agents are taking on more sensitive work across support functions. That raises the same control expectations practitioners already apply to NHI, PAM, and privileged workflows, but now in an agentic context where action can happen at runtime rather than on a fixed script.
Key questions
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.
Q: Why do audit trails matter for agentic workflows?
A: Audit trails matter because agentic workflows need a defensible record of what the agent saw, decided, and changed, especially when it acts with delegated authority. A good trail links the human owner, the agent identity, tool calls, data access, and the approval state, so security teams can investigate drift, replay actions, and revoke access after an unsafe decision.
Q: What is the difference between AI governance and AI runtime security?
A: AI governance focuses on policies, documentation, approvals, fairness checks, and regulatory evidence. AI runtime security focuses on protecting live models, prompts, data flows, and APIs while systems are running. Both matter, but they solve different problems: governance proves control, while runtime security prevents abuse, leakage, and unsafe behavior in production.
Q: When should security teams restrict agent access to customer systems?
A: Security teams should restrict agent access to customer systems before the agent can make external changes, handle personal data, or trigger irreversible actions without human review. Limit the agent to the narrowest API scopes, require step-up approval for a customer-facing or high-impact workflow, and bind access to a named human owner who can suspend the agent quickly.
Technical breakdown
Why agent permissions need a runtime boundary
AI agents that can interact with customer systems are not governed safely by static role assignment alone. The control problem is the moment an agent can choose which system to touch, when to act, and how far to propagate the result. In practice, that means the security boundary has to be defined around each action, not just around the workload that hosts the agent. Without a runtime boundary, guardrails become a paper policy while the agent still has broad operational reach. See the AI Agent Authorisation Guide.
Practical implication: Treat each agent action as an access decision and evaluate whether the privilege is task-scoped, time-bounded, and auditable.
How supply chain security thinking applies to agentic systems
Software supply chain security focuses on integrity, provenance, and trust in what is built and shipped. In agentic environments, the equivalent concern is what the agent can obtain, modify, or trigger through connected systems and dependencies. The issue is not only malicious code or poisoned builds. It is also whether downstream systems trust an automated actor that can move through data, credentials, and APIs with insufficient inspection. That makes supply chain discipline relevant beyond build pipelines and into operational identity governance. See the CI/CD Pipeline Identity Security Guide.
Practical implication: Extend provenance and trust checks from code delivery into the identities, tokens, and integrations an agent depends on.
Why audit trails matter more when automation is the actor
Audit trails are only useful when they capture who or what acted, what data or system was touched, and under which authority. With AI agents, the actor may be software making independent decisions inside a business workflow, which makes attribution and post-incident reconstruction harder than in traditional service automation. Logging therefore has to cover intent, tool use, approval state, and downstream effects. Otherwise, security teams can see that something happened but cannot prove whether the behaviour was expected, excessive, or unsafe. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Instrument agent actions with decision logs, tool-call records, and access context that support incident review and containment.
Breaches seen in the wild
- Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
- postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic security governance now depends on runtime authority, not just deployment trust: once AI agents can operate inside customer systems, the decisive question is what they are allowed to do at the moment of action. Static permissions and broad automation approvals do not answer that question cleanly, because the risk emerges in-session. Practitioners should treat this as a governance problem about action scope, not just a product safety feature.
Supply chain security has expanded from build integrity into operational trust boundaries: the Ensignia background matters because the same discipline that verifies code and pipelines now has to inform how agents interact with business systems. If an organisation can attest to software provenance but not to an agent's runtime authority, the trust model is incomplete. The implication is that supply chain thinking now reaches the identities and integrations that let automation execute.
Guardrails and audit trails are becoming the minimum viable control set for sensitive AI workflows: the more sensitive the workflow, the less tolerance there is for opaque automation. Security teams need evidence of what the agent could access, what it actually accessed, and what decision state existed at the time. audit and incident response becomes the operational record that determines whether automation is governable at all.
Named concept: runtime trust boundary: Serval's shift highlights a control gap that many programmes have not formally named. A runtime trust boundary is the point where an autonomous or semi-autonomous system crosses from being a managed workflow into a system that can affect production state. Once that boundary is unclear, governance becomes guesswork rather than policy enforcement. Practitioners should define and test that boundary before agents reach the most sensitive workflows.
From our research library:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Runtime trust boundary: AI automation becomes harder to govern once it can affect production state without a human in the loop. Security teams should expect access design to move from provisioning-time questions to action-time questions, because the control failure now appears inside the workflow rather than at the point of account creation.
The practical test is whether an organisation can prove what the agent was allowed to touch, what it actually touched, and whether those two things matched. Where that evidence does not exist, the workflow is operating ahead of governance and will need to be slowed, segmented, or removed from sensitive systems.
For practitioners
- Define runtime trust boundaries for AI agents Map every system an agent can touch, then classify which actions require task-scoped approval, which can run autonomously, and which must remain blocked.
- Separate build trust from operational trust Use software supply chain controls for code integrity, but add distinct governance for the identities, tokens, and API paths an agent uses at runtime.
- Instrument agent actions for auditability Capture tool calls, approval state, system targets, and execution outcomes so security teams can reconstruct agent behaviour during incident review.
- Review sensitive workflow ownership Assign explicit business and security owners for any AI workflow that can touch credentials, employee access, or customer systems, then review those owners on a fixed cadence.
Key takeaways
- AI agents that can operate in sensitive enterprise systems need runtime governance, not just deployment-time permissioning.
- The security issue shifts from whether automation is possible to whether its authority, access, and outcomes are provable.
- Audit trails, task-scoped access, and supply chain discipline now need to work together if automation is going to remain governable.
Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · CI/CD Pipeline Identity Security Guide · Agentic AI Identity Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10, MITRE ATT&CK and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI agents operating inside enterprise systems raise runtime privilege and authority questions. |
| Recommendation — Constrain agent privilege to the minimum task scope and verify every delegated action at execution time. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Agent access to credentials and customer systems maps to over-privileged non-human identity risk. |
| Recommendation — Review agent permissions for task-scoped least privilege and remove standing access where possible. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Sensitive agent workflows can expose credentials and spread access across connected systems. |
| Recommendation — Hunt for agent pathways that enable credential exposure or movement across connected enterprise systems. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The announcement centres on permissions and audit trails for automated access decisions. |
| Recommendation — Align automated workflow permissions with explicit authorisation and entitlement review. | ||
| CSA MAESTRO | Agentic AI threat modeling | The topic is agentic security governance across tools, workflows, and delegated action. |
| Recommendation — Model agent tool use, authority, and escalation paths before allowing sensitive workflow execution. | ||
Key terms
- Runtime Trust Boundary: A runtime trust boundary is the point where software must stop assuming trust and start verifying identity, context, and authorization before allowing action. In identity security, it separates approved execution from untrusted inputs, external services, or delegated agents, so access decisions can be enforced at the moment a workload or AI agent acts.
- Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.
- Audit Trail: An audit trail is a record of who accessed a system, what they did, and when they did it. For PHI environments, it provides the evidence needed to investigate incidents, support breach determinations, and demonstrate that access was attributable to a specific identity or workflow.
- Software Supply Chain Security: Software supply chain security is the practice of protecting the people, code, tools, dependencies, and delivery paths used to build and ship software. It covers source integrity, dependency risk, build system hardening, artifact signing, provenance, and release controls so malicious changes are detected before software reaches production.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org