Topic starter
06/06/2026 11:11 am
TL;DR: Enterprises are deploying AI agents faster than they are building governance to manage them, and Strata Identity says agents are already processing customer data, invoking tools through MCP, and chaining actions across cloud environments with minimal oversight. Static IAM, quarterly reviews, and human-era delegation models do not match agent runtime behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “Agentic AI Risks: A Guide to Proper AI Governance”.
By the numbers:
- 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from less than 5% in 2025.
Key questions
Q: Why do static IAM controls break down for AI agent execution?
A: Static IAM assumes privileges can be defined and reviewed in advance, but AI agents make decisions at runtime and can change their execution path during the session.
Q: Why do AI coding agents create access and governance risk even when they are not autonomous?
A: Because they already operate with tool access, repository access, and execution permissions inside a live workflow.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define runtime authorisation for agents Require every agent action to be evaluated at the moment of execution using initiator, task scope, resource need, and delegation context, rather than relying on static roles.
- Issue ephemeral identities for every agent task Replace shared service accounts, hardcoded API keys, and reused credentials with task-scoped identities that expire when the task ends.
- Enforce MCP gateway controls Route every MCP request through an enforcement point that validates identity, checks policy, and records the access decision before backend execution.
Bottom line: Agentic AI risk is emerging because enterprises are deploying agents into production faster than they are building controls that can govern runtime behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:51 am
Agentic AI governance fails when organisations keep using static identity assumptions for dynamic actors. Access reviews, role assignment, and semi-annual certification were built for identities whose effective privilege changes slowly. Agents execute thousands of actions per minute and can change tool use mid-session, so the governance model itself is out of date before the control completes. The implication is that identity governance must be evaluated at the moment of execution, not only at provisioning time.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when an AI agent delegates work to other agents?
A: Organisations should require a traceable delegation chain that records the initiating identity, each handoff, each tool call, and the business purpose of downstream access. Without that chain, teams cannot determine whether the final action still matched the original authorization or whether privilege expanded silently as the workflow progressed.
👉 Read our full editorial: Agentic AI governance is lagging deployment velocity in enterprises