Topic starter
06/07/2026 9:42 am
TL;DR: Secure agentic AI adoption is an identity and governance maturity problem, with 82% of enterprise leaders planning to deploy AI agents within three years while most organisations remain underprepared for autonomous access, according to Token Security. The real issue is not whether agents can work, but whether identity, access, and oversight models can contain independent tool use, scope drift, and shadow AI.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “New AI Security Guide to Secure Agentic AI”.
By the numbers:
- 82% of enterprise leaders plan to deploy AI agents in the next three years.
Key questions
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
A: Autonomous agents can optimize for the score you give them, not the intent behind it.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Map every agent to an accountable owner Create an authoritative inventory of all AI agents, including shadow AI, and tie each one to a named business and technical owner before granting broader access.
- Scope tool access by task and session Restrict OAuth grants, plugins, and shell access to the smallest viable task scope, then review whether privileges are still appropriate after each workflow.
- Separate discovery from enforcement Use discovery first to surface unknown agents, then apply access policy and remediation only after the inventory is complete and continuously maintained.
Bottom line: Agentic AI becomes a governance problem when autonomous systems can plan, decide, and act through enterprise tools without a human approval gate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:58 am
Agentic AI exposes a maturity gap, not a tooling gap: the central failure is that organisations are trying to govern autonomous behaviour with controls designed for static identities. Agentic systems plan and act in-session, so the real question is whether identity governance can keep up with runtime agency. The practitioner conclusion is that maturity, not product count, determines whether adoption is controllable.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise discovery or runtime enforcement first for AI governance?
A: Discovery comes first because runtime enforcement cannot be meaningfully scoped without knowing where AI exists and what it can access. Once the inventory is live, teams can apply policy checks, output controls, and retention requirements to the highest-risk systems first.
👉 Read our full editorial: Secure agentic AI adoption depends on identity maturity, not tools