Notifications
Clear all
Topic starter
18/08/2026 2:16 pm
TL;DR: AI agent control planes are emerging as the enforcement layer enterprises need because monitoring alone cannot stop unauthorized tool calls, reconstruct decisions for auditors, or revoke forgotten agent credentials, according to Obot. The governance problem is structural, not a dashboard gap: agent identity, policy enforcement, auditability, and reversibility must operate at runtime, not after the fact.
NHIMG editorial — based on content published by Obot: AI agents need more than monitoring, they need governance
By the numbers:
- 88.4% of organisations experienced at least one AI agent security breach in the past twelve months.
Questions worth separating out
Q: How should security teams govern AI agents that can choose tools at runtime?
A: Security teams should govern runtime agent choice as an access event, not as a simple application action.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when organisations manage agents like dashboards instead of governed identities?
A: What breaks is revocation, accountability, and incident reconstruction.
Practitioner guidance
- Define agent ownership before deployment Assign each agent to a named business or platform owner, bind it to a unique identity, and require a documented purpose, scope, and revocation path before production access is granted.
- Enforce policy at tool-call time Evaluate every high-risk tool invocation in context, including parameters, target system, and current state, rather than relying on session-level authorisation or prompt filtering alone.
- Create a clean revocation path Ensure any agent, connected service account, or tool integration can be disabled immediately without hunting across multiple workflows or teams, and verify that shutdown removes its effective access.
What's in the full article
Obot's full post covers the operational detail this post intentionally leaves for the source:
- The exact control-plane capability breakdown for identity issuance, policy enforcement, audit logging, and reversibility.
- The implementation distinctions between LLM gateways, MCP gateways, and agent identity layers in a production stack.
- The vendor's own architecture notes on integrating agent governance with existing identity providers and enterprise workflows.
- The deployment and operational considerations for running governance across multiple agent frameworks and environments.
👉 Read Obot's guide to AI agent control planes and governance →
AI agent control planes: what enterprises still miss about governance?
Explore further
18/08/2026 3:09 pm
AI agent governance is now an identity problem, not a model problem. The article is right to separate the control plane from the LLM and the MCP gateway because runtime authority is the failure domain. Once an agent can select tools, invoke them, and act without human approval at each step, identity scope becomes the decisive security boundary. Practitioners should stop treating agent governance as an overlay and recognise it as part of the identity stack.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent makes a destructive tool call?
A: Accountability sits with the organisation that allowed the runtime, connector, and policy model to exist together without sufficient control. In practice, that means security, platform, and application owners all share responsibility for the guardrails that should have stopped the action at the tool boundary.
👉 Read our full editorial: AI agent control planes define the governance layer enterprises need
