Notifications
Clear all
Topic starter
10/06/2026 12:08 am
TL;DR: Agentic AI systems can reason, plan, and act across enterprise tools with very little human oversight, but that same autonomy expands the attack surface and weakens static RBAC assumptions, according to Lasso Security. Existing IAM programmes now have to govern non-human actors that can initiate workflows, move data, and trigger downstream actions in real time.
NHIMG editorial — based on content published by Lasso Security: Top Agentic AI Use Cases Transforming Enterprise Operations
Questions worth separating out
Q: How should security teams govern AI agents that can act across enterprise systems?
A: Treat AI agents as non-human identities with defined owners, lifecycles, and task boundaries.
Q: Why do traditional IAM controls struggle with agentic AI?
A: Traditional IAM assumes access is relatively stable and tied to a known role.
Q: How do organisations reduce risk when AI agents handle sensitive data?
A: Limit the data domains an agent can touch, enforce fine-grained approval for exports or sharing, and store immutable logs that show what data the agent accessed and why.
Practitioner guidance
- Classify every agent as a governed non-human identity Assign ownership, lifecycle, and audit responsibility for each agent before production use.
- Replace static roles with task-scoped permissions Bind permissions to the job, the dataset, and the execution window.
- Require immutable step-level logging Capture the initiator, purpose, tool call, data touched, and outcome for every significant agent action.
What's in the full article
Lasso Security's full post covers the operational detail this post intentionally leaves for the source:
- A category-by-category breakdown of enterprise agent use cases across operations, growth, and security.
- Specific control patterns for context-based access control, just-in-time access, and cross-system traceability.
- Examples of human-in-the-loop triggers for low-risk, moderate-risk, and critical agent actions.
- Implementation detail on how Lasso frames discovery, classification, and continuous monitoring for agent workflows.
👉 Read Lasso Security's analysis of top agentic AI use cases and governance risks →
Agentic AI governance gaps in enterprise operations: what breaks first?
Explore further
11/06/2026 1:47 am
Agentic AI turns identity governance into runtime governance. The article makes clear that the control problem is no longer just who can access what, but what an identity can decide to do once access is active. That shifts the field away from static entitlement review and toward continuous governance of action, context, and delegated tools. Practitioners should read this as a structural change in IAM scope.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should teams review before deploying agentic AI in production?
A: Review whether the agent has a clear owner, a defined purpose, bounded tools, and a termination point for access. If those answers are vague, the deployment is already creating unmanaged privilege and audit exposure.
👉 Read our full editorial: Agentic AI governance gaps are widening in enterprise operations
12/06/2026 3:21 am
Agentic AI turns identity governance into runtime governance. The article makes clear that the control problem is no longer just who can access what, but what an identity can decide to do once access is active. That shifts the field away from static entitlement review and toward continuous governance of action, context, and delegated tools. Practitioners should read this as a structural change in IAM scope.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should teams review before deploying agentic AI in production?
A: Review whether the agent has a clear owner, a defined purpose, bounded tools, and a termination point for access. If those answers are vague, the deployment is already creating unmanaged privilege and audit exposure.
👉 Read our full editorial: Agentic AI governance gaps are widening in enterprise operations
