Notifications
Clear all
Topic starter
06/06/2026 11:15 am
TL;DR: AI agents now execute multi-step workflows across production systems, and the article argues that governable design depends on least agency and strong observability, according to WorkOS and the OWASP Top 10 for Agentic Applications. The practical lesson is that autonomy must be constrained before it is expanded, or review and audit become too weak to control real runtime behaviour.
NHIMG editorial — based on content published by WorkOS: The architecture of governable AI agents
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should security teams govern AI agents that can chain actions across tools?
A: Treat the agent as a runtime identity with bounded agency, not as a user session with extra automation.
Q: Why do AI agents create different identity risk than traditional automation?
A: Traditional automation follows predetermined rules, while an AI agent can choose actions, sequence them, and adapt mid-session.
Q: What do teams get wrong about least privilege for AI agents?
A: They often stop at permission scope and ignore behavioural scope.
Practitioner guidance
- Define agency boundaries before expanding autonomy Document which tools, data sets, and irreversible actions the agent may use, then remove any capability that is not required for the current task scope.
- Instrument identity-layer observability for every action Require each tool call to carry the agent ID, user ID, workflow ID, plan step, authorization decision, and delegation context so you can reconstruct authority later.
- Replace broad tools with narrow functions Break arbitrary APIs into specific actions such as lookup, retrieve, or update so the agent cannot improvise new request shapes outside the approved boundary.
What's in the full article
WorkOS' full blog post covers the implementation detail this post intentionally leaves for the source:
- How WorkOS structures RBAC and fine-grained authorization for tool-level agent control
- How OAuth 2.1 and sender-constrained tokens are used to scope agent credentials
- How the article maps OWASP Top 10 for Agentic Applications risks to agency and observability failures
- How to structure action-layer and identity-layer events for operational querying
👉 Read WorkOS' blog post on governable AI agents and runtime observability →
AI agent governance: are least agency and observability enough?
Explore further
06/06/2026 11:57 am
Least agency is the missing control concept for agentic AI governance. Least privilege answers what an identity can access, but not how much runtime discretion it has once access is granted. That leaves a structural gap in programmes that still assume policy boundaries are enough. In agentic environments, the control problem is decision freedom, not just entitlement breadth, and practitioners should treat agency as a first-class governance dimension.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should identity teams review when an AI agent is allowed to delegate?
A: Review the full delegation chain, not only the first identity that was authorised. Each hop should inherit a smaller permission set, a clear purpose, and a traceable authority link. If that attenuation is missing, delegated access can expand faster than the original approval ever intended.
👉 Read our full editorial: Least agency and observability are the core of governable AI agents
