Notifications
Clear all
Topic starter
23/06/2026 9:22 pm
TL;DR: AI systems can surface sensitive data, widen unauthorized exposure and trigger compliance issues when identity and access governance lag behind adoption, according to Gathid. The real problem is not AI capability but access control assumptions that were built for static users, not systems that can query across datasets and amplify hidden privileges.
NHIMG editorial — based on content published by Gathid: AI governance starts with identity and access management
Questions worth separating out
Q: How should security teams govern AI access to sensitive data?
A: Treat AI access as an identity governance problem, not only a model risk issue.
Q: Why do AI systems create new access control risks?
A: AI systems can combine broad retrieval capability with weakly governed permissions, which makes hidden data easier to surface.
Q: How do knowledge graphs help with AI governance?
A: Knowledge graphs help by showing how identities, permissions and data sources connect across systems.
Practitioner guidance
- Map AI access paths to data sensitivity tiers Inventory which datasets AI tools can reach, then classify those datasets by sensitivity, retention status and regulatory exposure.
- Pilot policy simulation before production rollout Use digital twin style testing to simulate how AI workflows behave under current permissions, especially where cross-functional data sources are involved.
- Replace static entitlements with context-aware enforcement Tie access decisions to device trust, session anomalies and role changes rather than only to the original grant.
What's in the full article
Gathid's full analysis covers the operational detail this post intentionally leaves for the source:
- Examples of how knowledge graphs can be used to trace access relationships across identities and datasets
- Practical scenarios for testing AI-driven workflows with digital twins before production deployment
- Further discussion of dynamic access controls, including contextual signals such as device trust and session anomalies
👉 Read Gathid's analysis of AI identity governance and access control →
AI access governance: are your controls keeping up?
Explore further
25/06/2026 2:39 am
AI governance fails when access is treated as a static permission problem. The article shows that AI can surface data that was never intended to be jointly visible, which means the real failure is not model intelligence but entitlement design. When access models assume the requester will stay within a predictable scope, AI becomes a boundary-testing layer that exposes how much hidden data sits behind old permissions. Practitioners should treat AI as a governance stress test for access architecture.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity inventories remain incomplete even before AI workflows are added.
A question worth separating out:
Q: Who should own AI access governance in an organisation?
A: Ownership should sit across IAM, IGA, security and data governance, with clear business accountability for each AI use case. AI access decisions affect entitlement design, data classification and compliance evidence, so no single team can manage them well in isolation. The practical answer is shared control with named accountability.
👉 Read our full editorial: AI identity governance is now the bottleneck for secure adoption
