Notifications
Clear all
Topic starter
14/08/2026 6:34 pm
TL;DR: Enterprise AI risk has shifted from data leakage in chat to uncontrolled agent actions, including exfiltration, destructive changes, and policy bypass, because most security stacks still lack session-level visibility into what agents actually do, according to Island. That makes runtime governance, not prompt review, the decisive control boundary.
NHIMG editorial — based on content published by Island: AI Protect: Governing What Agents Do, Not Just What They're Told
By the numbers:
- Gartner expects AI agents to outnumber human users 10 to 1 in large enterprises within a few years.
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents break traditional IAM assumptions?
A: AI agents break IAM assumptions because they do not behave like predictable users.
Q: What do security teams get wrong about agent visibility?
A: They often treat prompts or logs as sufficient proof of control.
Practitioner guidance
- Map every agent action to an identity control point Identify where prompts, tool calls, file access, browser actions, network egress, and sub-agent invocation are observable, then decide which control point is authoritative for each event.
- Classify agent permissions as session-scoped entitlements Review which tools, MCP servers, and skills an agent can invoke in each scenario, and tie those permissions to user context, device posture, and task scope.
- Add runtime blocks for destructive and exfiltration actions Write policy conditions that stop database deletion, external file transfer, shell execution, and other irreversible actions before the session completes.
What's in the full article
Island's full post covers the operational detail this analysis intentionally leaves for the source:
- How AI Protect evaluates prompt, tool-call, and response content inline across a session
- How the control plane distinguishes allow, prompt, and block responses for risky agent actions
- How Agentic Endpoint Posture and Agentic Identity feed the AI Protect policy decision
- How Island ties agent behaviour to browser, endpoint, network, MCP gateway, and telemetry controls
👉 Read Island's analysis of governing AI agent actions at runtime →
AI agent actions, not prompts: are your controls keeping up?
Explore further
14/08/2026 6:41 pm
Action governance is now the core identity problem for AI agents: The article captures a shift from prompt-centric thinking to runtime control of what an agent actually does. That shift matters because the security boundary is no longer the instruction, but the tool call, file touch, network action, and irreversible change that follows. Practitioners should treat agent action as an identity event, not an application event.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
A question worth separating out:
Q: Who is accountable when an AI agent makes a destructive tool call?
A: Accountability sits with the organisation that allowed the runtime, connector, and policy model to exist together without sufficient control. In practice, that means security, platform, and application owners all share responsibility for the guardrails that should have stopped the action at the tool boundary.
👉 Read our full editorial: AI agent governance now depends on action-level control
