Notifications
Clear all
Topic starter
24/06/2026 10:45 pm
TL;DR: Agentic AI governance fails when static risk tiers, fixed autonomy levels, and periodic review models are applied to systems that make context-dependent decisions, use tools, and shift accountability at runtime, according to Zenity. The governing assumption that access can be provisioned, reviewed, and certified as a stable state collapses once an agent can change scope mid-session.
NHIMG editorial — based on content published by Zenity: Governing Agentic AI, a practical framework for the enterprise
Questions worth separating out
Q: How should security teams govern agentic AI in enterprise environments?
A: Security teams should govern agentic AI as a runtime identity and access problem, not as a model-only policy exercise.
Q: Why do static AI governance frameworks fail for autonomous agents?
A: Static frameworks fail because they assume decision authority, autonomy, and accountability are stable enough to classify in advance.
Q: What do organisations get wrong about embedded AI agents in SaaS tools?
A: They often treat embedded agents as a feature setting instead of a new access surface.
Practitioner guidance
- Define agent identity boundaries Assign each agent a named identity, explicit permission scope, and owner before any production use.
- Map controls by deployment model Separate homegrown agents, endpoint agents, and embedded SaaS agents in your policy model.
- Instrument runtime tool use Log tool calls, data access, inter-agent communication, and approval states so that behaviour can be reconstructed after the fact.
What's in the full article
Zenity's full article covers the operational detail this post intentionally leaves for the source:
- Deployment-model breakdowns for homegrown, endpoint, and SaaS-embedded agents
- Practical governance questions for vendor risk reviews and embedded agent controls
- Examples of runtime monitoring and auditability questions to ask during implementation
- The article's full discussion of adaptive governance and critical trust thresholds
👉 Read Zenity's framework for governing agentic AI in the enterprise →
Agentic AI governance: what controls fail when agents act at runtime?
Explore further
25/06/2026 7:33 am
Static AI governance categories are already obsolete for agentic systems. Risk tiers and fixed oversight models were designed for systems whose behaviour is bounded at design time. Agentic AI shifts decision authority and autonomy by context, which means governance has to move with the workload rather than sit above it. The implication is that enterprise programmes need dimensional governance, not another static policy layer.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who should own accountability when an agent chains multiple actions and causes harm?
A: Accountability should be assigned through the full decision chain, not only to the model builder or the end user. The practical test is whether the organisation can reconstruct who authorised the agent, what it could access, what tools it used, and when the oversight state changed.
👉 Read our full editorial: Agentic AI governance needs adaptive controls, not static categories
