Topic starter
02/08/2026 11:45 am
TL;DR: AI agents are running autonomously across endpoints, files, tools, and data stores, and legacy DLP and EDR cannot govern machine-speed behaviour without human oversight or a reliable audit trail, according to Cyberhaven’s whitepaper. The governance problem is no longer theoretical: access review and containment models built for human-paced identity break when agents decide and act inside the same session.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “Governing the Autonomous Enterprise: A Security Framework for Agentic AI”.
Key questions
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do legacy data loss prevention controls miss risk in agentic AI environments?
A: Legacy DLP misses risk because it was designed for a world where humans directly moved files and messages.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Define agent runtime authority boundaries Separate what an AI agent may observe, decide and execute from what a human operator may approve after the fact.
- Inventory autonomous agents and their data paths Map where agents run, which tools they can call, which data stores they can touch and which downstream systems inherit their outputs.
- Instrument lineage for high-risk agent workflows Capture source, transformation and destination data events so investigations can reconstruct the full path of an agent action.
Bottom line: Agentic AI is already operating across enterprise systems, and the governance problem is that legacy endpoint and data-loss controls were not built for machine-speed action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:56 pm
Agentic AI governance is not an extension of classic NHI hygiene: it is a different control problem because the identity decides and acts at runtime. That means the control boundary moves from periodic review to the moment of authorisation and execution. Security teams that keep treating agents as scripted workloads will miss the governance gap that defines the category.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams handle AI agents that can act before humans can review each step?
A: They should move governance from post-action review to action-time control. That means every production agent needs bounded permissions, traceable tool use, and a clear owner who can explain and stop its behaviour when it changes. If the system can act independently, the control point has to exist before the action completes.
👉 Read our full editorial: Governing agentic AI identities requires new enterprise controls