Topic starter
24/06/2026 7:25 pm
TL;DR: AI agents are moving into operational workflows faster than most organisations can track them, and Collibra argues that continuous visibility, signals, exception-based response and automated intervention are now necessary to keep AI under control. The deeper issue is that governance models built for static inventories cannot manage systems that change and act in motion.
Editorial analysis by NHI Mgmt Group, based on content published by Collibra: “Delivering AI at race pace without losing control”.
Key questions
Q: How should security teams secure AI agents before they are embedded into business workflows?
A: Security teams should treat AI agents as a distinct identity and access problem, not just an application feature.
Q: Why do traditional identity and governance controls miss the biggest risks in agentic AI?
A: Traditional controls are usually designed to manage logins, models, or data assets, not the full sequence of agent actions in real time.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Map every agent to a live system inventory Track agents, models, datasets and workflows in one continuously updated view so teams can see how changes propagate across the operating chain.
- Define behavioural signals for material drift Set thresholds for unexpected agent actions, model instability and relationship changes so governance triggers on meaningful deviation rather than on schedule.
- Shift oversight from reviews to exception handling Focus governance attention on cases where risk, impact or behaviour materially changes, and avoid trying to manually inspect every action.
Bottom line: AI agent governance fails when control loops are still built for static inventories while the underlying systems are changing in motion.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:42 am
Continuous AI governance is becoming a runtime identity problem, not a documentation problem. The article is describing a control model that breaks because organisations still govern AI as though it were a static asset set. Once agents are embedded in workflows, the challenge becomes who can observe, constrain and intervene while the system is acting. The practical conclusion is that governance must be designed as an operating control, not a record-keeping function.
A question worth separating out:
Q: Should organisations prioritise identity governance before expanding agentic AI?
A: Yes. Organisations should establish ownership, least privilege, monitoring, and revocation for machine identities before broadening agentic AI use. Without those controls, each new agent can multiply blast radius and create shadow access that is hard to unwind after an incident.
👉 Read our full editorial: AI agent governance breaks when control lags behind deployment