Topic starter
25/10/2026 11:03 am
TL;DR: Two weak points matter most in agentic systems: the AI supply chain and runtime control failures, according to Jozu. Governance has to move into action-scoped checks and provenance controls where agents invoke tools and act at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Jozu: “Your Organization Is Further Along the AI Curve Than You Think. Thatâs the Problem.”.
By the numbers:
- 40% of enterprise applications will embed AI agents by the end of 2026, up from 5% in 2025.
- Documented AI failures, attacks, and misuse rose more than 55% in 2025 alone.
Key questions
Q: Why does AI make software supply chain risk harder to control?
A: AI increases the amount of code produced, which reduces the time available for review and makes malicious or unauthorized changes harder to spot.
Q: Where do traditional AI gateways and guardrails fail in agentic environments?
A: They fail where the action actually happens.
Q: What should IAM and security teams do first when AI adoption accelerates?
A: They should start with a unified inventory of sensitive data and the tools that can reach it.
Practitioner guidance
- Map the real highest-risk AI first Identify which AI systems are already handling sensitive data, tool calls, or workflow automation, then compare that reality with the approved programme boundary.
- Define the next 12-month operating state Set the access, logging, and approval model you will need once adoption expands, not the one that only fits today's pilot footprint.
- Bring security, data science, and platform teams together Align on what acceptable agent behaviour looks like, who approves new artifacts, and which runtime actions must be blocked regardless of user demand.
Bottom line: Agentic AI changes the control problem from software security to identity governance, because the actor can invoke tools and move across systems at runtime.
Glossary terms: Agentic AI, AI supply chain, Runtime control, Agent Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Agentic AI creates an identity boundary problem, not just a model safety problem: the article's core lesson is that governance fails when organisations keep treating agents as if they were static software components. Once an agent can choose tools, act at runtime, and propagate work across systems, the security question becomes who can authorise that behaviour and under what constraints. The practitioner implication is that AI governance has to sit inside identity and access control, not beside it.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations govern AI agents without slowing operations?
A: Give AI agents narrowly scoped permissions, define which tools they may use, and log every privileged action with clear ownership. Governance should focus on action boundaries and exception handling, not on blocking all automation. The goal is to keep autonomy useful while preventing agents from inheriting broad, persistent access.
👉 Read our full editorial: Agentic AI breaks current security stacks at adoption speed
This post was modified 7 days ago by NHI Mgmt Group