Notifications
Clear all
Topic starter
24/06/2026 7:25 pm
TL;DR: AI agents are moving into operational workflows faster than most organisations can track them, and Collibra argues that continuous visibility, signals, exception-based response and automated intervention are now necessary to keep AI under control. The deeper issue is that governance models built for static inventories cannot manage systems that change and act in motion.
NHIMG editorial — based on content published by Collibra: Delivering AI at race pace without losing control
Questions worth separating out
Q: How should security teams govern AI agents that act inside business workflows?
A: Security teams should govern AI agents as runtime actors, not static applications.
Q: Why do static inventories fail for AI agent governance?
A: Static inventories fail because they capture a point in time, while AI systems change continuously through data shifts, model updates and workflow interactions.
Q: What breaks when AI behaviour is only reviewed at fixed checkpoints?
A: What breaks is timing.
Practitioner guidance
- Map AI agent runtime dependencies Create a live inventory of agents, models, data sources and workflow touchpoints so you can see how one change propagates through the chain.
- Define behavioural signals for agent drift Set thresholds for unexpected action, dependency change, and output inconsistency, then tie each signal to a specific business owner.
- Shift governance to exception handling Move away from reviewing every system equally and decide which signals require human intervention, automated containment or both.
What's in the full article
Collibra's full blog post covers the operational detail this post intentionally leaves for the source:
- The article's framing of how AI systems evolve as connected systems rather than isolated tools.
- Examples of the control capabilities the vendor associates with continuous visibility, signals and intervention.
- The supply chain forecasting scenario used to illustrate drift detection and response.
- The conference context and speaker perspective behind the editorial argument.
👉 Read Collibra's analysis of AI governance when agents move faster than control →
AI agent governance: are your control loops keeping up?
Explore further
25/06/2026 4:42 am
AI governance is becoming an identity governance problem. Once agents are embedded in workflows and allowed to act across business processes, the question is no longer only model accuracy. It becomes who or what is acting, under what authority, and with what traceable relationship to data and business context. That places AI agents squarely in the same governance conversation as other non-human identities, even when the underlying risk looks operational rather than credential-based. Practitioners need to treat agent behaviour as governed identity behaviour, not as a side effect of automation.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, showing that confidence and execution diverge across the lifecycle, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who should own AI agent control when models, data and workflows are connected?
A: Ownership should sit across IAM, data governance and AI governance, with clear escalation paths for runtime anomalies. No single team can see the full dependency chain on its own, so accountability has to be shared while specific response actions remain assigned to named operators.
👉 Read our full editorial: AI agent governance breaks when control lags behind deployment
