Notifications
Clear all
Topic starter
06/06/2026 1:49 am
TL;DR: Traditional security tools cannot secure AI agents because they were designed around user-centric identity, event-based visibility, and fixed data paths, according to Zenity and Gartner’s April 2026 evaluation. The governance problem is structural, because agent behavior, layered identities, and runtime intent invalidate assumptions that legacy IAM and detection stacks rely on.
NHIMG editorial — based on content published by Zenity: Why Purpose-Built Architecture Wins in AI Agent Governance
By the numbers:
- Gartner named Zenity the company to beat in the AI Agent Governance category in its AI Vendor Race report as of 17 April 2026.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: How should security teams govern AI agents that use multiple identity layers?
A: Security teams should inventory every identity layer an agent can use, including static credentials, session identities, embedded tool identities, and any delegated relationships between agents.
Q: Why do event-based tools struggle with AI agent governance?
A: Event-based tools struggle because they see isolated actions, not the full intent behind a chain of actions.
Q: What breaks when organisations try to retrofit IAM controls onto AI agents?
A: Retrofit IAM breaks when the control model assumes a stable human session or a single workload identity.
Practitioner guidance
- Inventory agent identity layers separately Document static credentials, session identities, tool identities, and any agent-to-agent relationships before assuming a single account view is enough.
- Replace event-only detection with session-level intent review Correlate tool calls, memory access, and data use across the full execution chain so you can judge whether the agent’s behaviour still matches the approved task.
- Classify agent environments by deployment pattern Separate SaaS-managed, home-grown, and device-based agents in your inventory and controls, because each requires a different discovery and enforcement path.
What's in the full article
Zenity's full article covers the operational detail this post intentionally leaves for the source:
- How the Observe, Govern, and Defend workflow is structured across discovery, posture, investigation, and enforcement.
- What the Clarity Agent and stateful threat engine do during runtime analysis of agent behaviour and intent drift.
- How Zenity Issues assembles posture findings, runtime anomalies, identity relationships, and attack paths into a single incident view.
- Why the article expects context-responsive policy to become the next stage of agent authorization design.
👉 Read Zenity's analysis of AI agent governance architecture and intent-aware detection →
AI agent governance architecture: what changes for IAM teams?
Explore further
06/06/2026 3:09 am
Purpose-built architecture is the category requirement for AI agent governance. Agents break the core assumptions of user-centric security tools by chaining tool calls, switching context mid-session, and moving across identity layers that legacy controls treat separately. That means a retrofit approach can show activity without showing meaning. The implication is that AI agent governance must be designed as a native control plane, not as an add-on to SIEM, DLP, or standard IAM.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: What is the difference between visibility and governance in AI agent security?
A: Visibility tells you that an agent exists and what it touched. Governance tells you whether that agent was allowed to do it, whether its behaviour stayed aligned with intent, and whether enforcement can intervene before damage spreads. A mature programme needs both, but governance is what turns inventory into control.
👉 Read our full editorial: AI agent governance needs purpose-built architecture, not retrofits
