Topic starter
09/06/2026 11:12 pm
TL;DR: Enterprise AI agent creation is spreading beyond R&D into business teams, expanding exposure to sensitive data, uncontrolled access, and unauthorized actions as agents connect to internal systems, according to Lasso Security. Build-time discovery and dependency mapping matter because security cannot rely on post-deployment review when agent trust, access, and delegation are established before production.
Editorial analysis by NHI Mgmt Group, based on content published by Lasso Security: “Build Secure-By-Design Agents with Lasso”.
Key questions
Q: What should teams check before putting an AI agent into production?
A: Teams should verify three things before production: the agent has a unique identity, its permissions are minimal and explicitly approved, and its actions are fully auditable.
Q: Why is build-time discovery important for AI agent security?
A: Because the most important security decisions are often made before an agent ever runs.
Q: What breaks when AI agent access is reviewed only after the fact?
A: After-the-fact review leaves a gap between action and containment.
Practitioner guidance
- Inventory agents at creation time Require every new AI agent to be registered when it is built, with ownership, purpose, and connected systems recorded before it is permitted to interact with internal resources.
- Map delegation chains and dependencies Document every LLM, API, database, sub-agent, and business application an agent can reach, then mark where authorization boundaries are implied rather than explicitly enforced.
- Route findings to builders Tie posture findings to the team that created the agent so weak dependencies, unsafe permissions, and missing controls are fixed while the agent is still in development.
Bottom line: AI agent security cannot rely on post-deployment review when trust and delegation are established during creation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/06/2026 1:27 am
AI agent posture management is becoming an identity governance problem, not just an application security problem. The article shows agents being created across business functions and connected to internal resources long before security teams would traditionally review them. That means the governance question is no longer only whether the agent is secure, but whether the organisation can identify, own, and scope its non-human identities at creation time. Practitioners should treat agent discovery as a lifecycle control, not an after-the-fact scan.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to the State of Non-Human Identity Security.
- That includes 38% with no or low visibility and 47% with only partial visibility, which shows how quickly delegated access can outpace governance even before AI agents are added.
A question worth separating out:
Q: How should organisations prioritise fixes for AI agent security findings?
A: Organisations should prioritise the agents with the widest connected footprint, the highest business criticality, and the most unclear ownership. That approach focuses remediation where the delegation chain creates the greatest operational exposure, instead of treating every finding as equal.
👉 Read our full editorial: Secure-by-design AI agents need posture management from build time
11/06/2026 12:32 am
AI agent posture management is becoming an identity governance problem, not just an application security problem. The article shows agents being created across business functions and connected to internal resources long before security teams would traditionally review them. That means the governance question is no longer only whether the agent is secure, but whether the organisation can identify, own, and scope its non-human identities at creation time. Practitioners should treat agent discovery as a lifecycle control, not an after-the-fact scan.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to the State of Non-Human Identity Security.
- That includes 38% with no or low visibility and 47% with only partial visibility, which shows how quickly delegated access can outpace governance even before AI agents are added.
A question worth separating out:
Q: How should organisations prioritise fixes for AI agent security findings?
A: Organisations should prioritise the agents with the widest connected footprint, the highest business criticality, and the most unclear ownership. That approach focuses remediation where the delegation chain creates the greatest operational exposure, instead of treating every finding as equal.
👉 Read our full editorial: Secure-by-design AI agents need posture management from build time
12/06/2026 2:05 am
Build-time posture management is the right control plane for enterprise AI agents. The article describes a deployment pattern where agents are created outside traditional security workflows and then connected to internal systems. That means the first meaningful governance moment is not runtime monitoring, but the point of construction. For AI agents, posture management has to begin where trust is assigned, not where incidents are detected. The practitioner conclusion is straightforward: if you cannot govern creation, you are already behind.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do security teams decide which AI agents to fix first?
A: Prioritise the agents that combine business criticality with the broadest dependency chains and the most sensitive data paths. That combination tells you where an unreviewed agent could create the largest blast radius, and it gives development teams a concrete order for remediation.
👉 Read our full editorial: Secure-by-design AI agents need posture management from build time