Notifications
Clear all
Topic starter
10/06/2026 12:04 am
TL;DR: AI agents are now operating as autonomous actors inside enterprises, with adoption above 72% of organizations and 40% already running multiple agents in production workflows, according to Pillar Security. The security problem is no longer visibility alone but action control, because static access policy cannot safely govern machine-speed decisions that chain tools and permissions.
NHIMG editorial — based on content published by Pillar Security: Securing the Agentic Workforce
By the numbers:
- The average employee navigates around 10 different applications a day.
Questions worth separating out
Q: How should security teams govern autonomous AI agents in production?
A: Security teams should govern autonomous AI agents as runtime identities, not just applications.
Q: Why do autonomous agents break existing IAM assumptions?
A: Autonomous agents break IAM assumptions because identity no longer maps cleanly to a stable human operator or a fixed request.
Q: What do teams get wrong about shadow AI agents?
A: Teams often assume that if an agent is not in central IAM, it is not part of the security problem.
Practitioner guidance
- Map every autonomous agent to an accountable owner Create an inventory of agent identities, the data and systems they touch, and the human team responsible for each agent’s runtime behaviour.
- Move from session approval to action-level control Require policy checks at each meaningful agent action, especially tool calls, database writes, external API requests, and workflow triggers.
- Separate agent privileges from human workflows Do not inherit human access patterns for autonomous systems.
What's in the full article
Pillar Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The platform architecture across AI ecosystem integrations, AI posture, runtime controls, and governance layers.
- How the vendor maps agentic identity management to continuous discovery and real-time enforcement.
- Examples of adaptive guardrails, AI gateway enforcement, and tool or MCP protection in live environments.
- The reporting and audit features used for compliance and incident response mapping.
👉 Read Pillar Security's analysis of securing the agentic workforce →
Agentic workforce governance: are your controls keeping up?
Explore further
11/06/2026 1:41 am
Autonomous identity governance is collapsing because access review assumes access remains stable long enough to be reviewed. That assumption was designed for human-paced and service-account-paced control loops. It fails when an autonomous agent can acquire context, combine tools, and complete harmful action chains within a single session. The implication is that existing review cadences no longer describe the actual risk state, so practitioners must rethink what governance is trying to observe.
A few things that frame the scale:
- Independent surveys put adoption above 72% of organizations either using or testing AI agents, with 40% running multiple agents in production workflows, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should organisations do before scaling agentic workflows?
A: Before scaling agentic workflows, organisations should define who owns each agent, what it is allowed to do, and where intervention will happen if behaviour drifts. They should also test whether tools can be chained into unsafe outcomes even when individual permissions look reasonable. That is the real governance test for autonomous systems.
👉 Read our full editorial: Securing the agentic workforce: why existing IAM controls fail
12/06/2026 3:15 am
Autonomous identity governance is collapsing because access review assumes access remains stable long enough to be reviewed. That assumption was designed for human-paced and service-account-paced control loops. It fails when an autonomous agent can acquire context, combine tools, and complete harmful action chains within a single session. The implication is that existing review cadences no longer describe the actual risk state, so practitioners must rethink what governance is trying to observe.
A few things that frame the scale:
- Independent surveys put adoption above 72% of organizations either using or testing AI agents, with 40% running multiple agents in production workflows, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should organisations do before scaling agentic workflows?
A: Before scaling agentic workflows, organisations should define who owns each agent, what it is allowed to do, and where intervention will happen if behaviour drifts. They should also test whether tools can be chained into unsafe outcomes even when individual permissions look reasonable. That is the real governance test for autonomous systems.
👉 Read our full editorial: Securing the agentic workforce: why existing IAM controls fail
