Topic starter
22/06/2026 9:58 am
TL;DR: Auditors are shifting from asking whether AI agents had the right access to asking what the agents actually did and whether that behaviour was appropriate, according to Zenity; execution logs alone no longer satisfy emerging expectations from the EU AI Act, NIST AI RMF, and Singapore guidance. Access control is now only the starting point, because behavioural observability is becoming the real compliance test.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “What Auditors and Regulators Are Starting to Ask About AI Agents”.
Key questions
Q: Which governance evidence should compliance teams expect for AI agents?
A: Compliance teams should expect an inventory of agents, a record of what data they can access, mapped test results against known attack techniques, and a remediation trail for failed findings.
Q: Why are traditional access logs not enough for AI agent governance?
A: Traditional logs capture isolated events, but agent activity is a connected sequence of decisions and actions.
Q: What are the signs that AI agent audit logging is failing in practice?
A: A failing audit system usually looks like receipts instead of records.
Practitioner guidance
- Define behavioural evidence requirements Specify which agent actions, tool calls, decision points, and supervisory events must be retained for each regulated workflow so later review can reconstruct the full task chain.
- Separate execution logs from compliance evidence Keep system telemetry for operations, but add a distinct audit layer that captures purpose, sequence, and override conditions for every material agent session.
- Map regulated data paths for agent activity Identify where AI agents access personal, confidential, or high-risk data so the audit trail can show purpose limitation and oversight at those points.
Bottom line: AI agent governance is moving beyond access approval toward proof of behaviour, purpose, and oversight.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:40 am
Behavioral observability is becoming the compliance floor for agentic AI. Access authorization answers a permission question, not an assurance question. Once an AI agent can combine tools and decisions inside one task, regulators will expect evidence of what the agent did and whether that conduct stayed inside the approved use case. The practical implication is that audit design now belongs in agent architecture, not only in policy.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Security teams should log the agent identity, the human or role that authorized action, the configuration and model version in effect, and the full access control path behind each decision. They should also record log creation time, retention period, and integrity hashes. Together, those fields make an audit trail usable for incident response, compliance review, and non repudiation.
👉 Read our full editorial: AI agent audit trails are shifting from access to behaviour