Vertex AI governance shows why agentic AI needs control planes

At a glance

What this is: NHI Mgmt Group's analysis, drawing on AvePoint's blog post: Agentic AI is moving into production workflows, and the central finding is that governance, data trust, and operational readiness are now the limiting factors rather than model capability.

Why it matters: This matters because practitioners now have to govern AI systems that act, not just generate, which brings identity, access, data lineage, and auditability into the same control plane.

By the numbers:

• 35% of organizations already use agentic AI, according to AvePoint.
• 44% plan to adopt agentic AI as they shift from experimentation to operational deployment, according to AvePoint.
• 86% of organizations have delayed AI projects due to security and data quality concerns, according to AvePoint.

Context

Agentic AI changes the security problem because the system is no longer only producing output, it is acting inside enterprise workflows. That shift means the control question moves from output quality to governance over data, actions, and delegated authority.

The article frames the familiar pattern correctly: fragmented tooling and unclear ownership become operational liabilities once agents run continuously across systems. For identity teams, that means AI behaviour now intersects with agent identity governance rather than sitting outside it.

Key questions

Q: How should teams govern agentic AI inside IGA workflows?

A: Start by limiting the agent to evidence discovery and workflow drafting, while keeping approval authority and policy changes under human control. The model may speed up review, but it should not be allowed to silently convert findings into access decisions. Governance should focus on who can query data, what the agent may generate, and which steps remain mandatory for approvers.

Q: Why do autonomous AI workflows create more security risk than traditional endpoint activity?

A: Autonomous AI workflows create more risk because a command result may no longer map cleanly to a human action. A single outcome can originate from a person, an AI agent acting on their behalf, a prompt injection, or an automated workflow. Without prompt-to-action attribution, teams lose the context needed to judge whether activity is legitimate or harmful.

Q: What are the signs that tool governance is failing in an AI agent programme?

A: Common signs include broad tool permissions, reusable credentials across unrelated services, approvals happening only after execution, and poor traceability from tool action back to a human principal. If the organisation cannot explain who authorised a consequential call and why, governance is already too weak for the risk level.

Q: Should organisations prioritise data governance or agent controls first?

A: They have to do both, but data governance usually exposes the fastest risk because agents inherit whatever permission state and content quality already exist. If the underlying repositories are messy or overshared, adding more agent controls will not restore trust in the workflow.

Technical breakdown

Why unified control planes matter for agentic AI

Agentic AI introduces multistep execution across models, tools, data sources, and orchestration layers. A unified control plane reduces the chance that each layer develops its own policy, logging, and ownership model. That matters because an agent that can decide, call tools, and continue a workflow needs consistent enforcement across the full path, not just a checkpoint at the model boundary. In practice, the architectural question is whether governance is attached to the workflow, or bolted on after the fact. When the platform separates orchestration from oversight, teams inherit blind spots in auditability and policy drift. Practical implication: align governance to the workflow path, not to a single AI component. See the Agentic AI Security Guide.

Practical implication: align governance to the workflow path, not to a single AI component.

How grounding in enterprise data expands the attack surface

Retrieval-augmented generation lets agents use enterprise content to improve relevance, but it also imports the quality and permission state of every connected source. If the underlying content is overshared, stale, or poorly classified, the agent can amplify those weaknesses at machine speed. The control challenge is no longer just whether a user can access a document, but whether an autonomous system should inherit that access and act on it. That creates a governance problem across visibility, lineage, and access scope. Practical implication: treat grounded data sources as governed inputs, not passive context.

Practical implication: treat grounded data sources as governed inputs, not passive context.

Why agent observability becomes an identity control issue

When agents execute across systems, observability has to show what identity acted, on which data, under which policy, and with which outcome. Without that, teams cannot distinguish legitimate automation from mis-scoped autonomy. This is where identity and audit converge: the agent must be attributable, its delegated scope must be legible, and its actions must be traceable across the workflow. A managed runtime helps, but only if logging captures the decision path, not just the final action. Practical implication: design auditability around agent identity, delegation, and action traceability. See the AI Agent Observability, Audit and Incident Response Guide.

Practical implication: design auditability around agent identity, delegation, and action traceability.

Threat narrative

Attacker objective: The objective is not a classic intrusion but uncontrolled business action, where autonomy is used to produce exposure, error, or policy drift at scale.

1. Entry occurs when an agent is given access to enterprise data sources and workflow tools without sufficiently governed scope or input quality controls.
2. Escalation follows when the agent uses overshared documentation, stale content, or broad permissions to take actions beyond the intended business context.
3. Impact arises when autonomous workflow execution spreads inaccurate decisions, data exposure, or unauthorized actions across connected systems.

NHI Mgmt Group analysis

Agentic AI governance debt is now the core deployment risk. The article shows that the hard part of production AI is not model access but the accumulation of weak ownership, thin auditability, and unclear policy boundaries. That is governance debt in the same sense that technical debt compounds over time: every unmanaged workflow makes later control harder and more expensive. Practitioners should treat agent rollout as a governance programme, not a feature rollout.

AI systems now need identity discipline, not just model controls. Once agents can act on enterprise data and tools, the relevant security question becomes who or what is acting, under what authority, and with which lifecycle guardrails. That aligns directly with agent identity governance and with the broader need to distinguish a model from an actor. Teams that fail to formalise that distinction will struggle to enforce least privilege or to explain agent behaviour after the fact.

Data trust has become an operational security dependency. The article correctly places permission sprawl, stale content, and weak data hygiene at the centre of agent risk. That means a supposedly reliable AI stack can still generate unsafe actions if its inputs are poorly governed. For security leaders, the implication is straightforward: data governance is now part of runtime control, not a separate compliance stream.

Agentic AI platforms are becoming control planes for autonomy. The market is moving toward environments that bundle orchestration, infrastructure, and governance because point solutions cannot easily sustain continuous agent operations. That does not remove risk, but it does make control patterns more legible for audit and policy enforcement. Practitioners should expect the category to converge around governance-first architecture rather than isolated model hosting.

Named concept: autonomy without attribution. This article highlights the failure mode where agents can take action, but teams cannot reliably attribute the decision path, delegated scope, or data used. That is a control gap, not a visibility inconvenience. The practical consequence is that any enterprise agent programme without attribution and traceability will be difficult to trust at scale.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
• Read next: Agentic AI Identity Guide

What this signals

Autonomy without attribution will become a common governance failure mode as organisations move from pilot agents to production workflows. If teams cannot attribute which identity acted, what data it used, and why it was allowed to proceed, the control plane has already fallen behind the workflow.

Agentic programmes should be measured less by model sophistication and more by whether permission scope, data lineage, and action traceability stay intact as scale increases. That is the practical boundary between usable autonomy and unmanaged automation.

The most durable programmes will move governance closer to execution time, where policy decisions can be enforced before an agent completes a task, not after the damage is already embedded in downstream systems.

For practitioners

• Define the agent identity model Assign each agent a clear identity, delegated authority, and retirement path before it touches production workflows.
• Constrain grounded data sources Limit which repositories, shared drives, and collaboration spaces agents can read, and review permissions before enabling retrieval.
• Log decision paths, not just outputs Capture the prompt, retrieved data, tool calls, policy decision, and final action so reviews can reconstruct agent behaviour.
• Separate model choice from governance Treat model flexibility as an architectural decision, but keep policy enforcement, audit, and access rules consistent across deployments.
• Review autonomous workflow boundaries Identify where an agent can continue a process without human intervention and require escalation points for high-impact actions.

Key takeaways

• Agentic AI introduces a governance problem as much as a technical one, because autonomous workflows can act across systems before humans can review them.
• The article points to a broader pattern of adoption pressure, with security and data quality delays showing that readiness now matters more than experimentation.
• The most important control shift is to make identity, data scope, and auditability part of the execution path rather than bolting them on afterward.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Security Guide

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Governance Debt: The accumulation of unresolved identity control weaknesses created when teams prioritise speed over lifecycle design. In NHI environments, it shows up as accounts with unclear ownership, undocumented purpose, stale credentials, and no reliable retirement path, all of which make later security work harder.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and workload identity. It helps practitioners translate autonomy risk into access, lifecycle, and control decisions that can be applied in production.