AI agent governance gaps: are your controls keeping up?

NHI Mgmt Group · 2026-06-25T15:30:41+00:00

TL;DR: Security teams cannot see what AI agents access, how they change behavior, or which tools they chain together once deployed, according to Zenity. That visibility gap makes prompt filtering and other input-focused controls insufficient because the real risk sits in agent autonomy and runtime decision-making. Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Zenity CEO Ben Kliger with Safety Detectives: Most Security Teams Have No AI Agent Strategy. Here’s How to Build One”. Key questions Q: What breaks when organisations rely only on prompt filtering to secure AI agents? A: Prompt filtering can reduce obvious abuse, but it does not stop a compromised agent that has already accepted malicious instructions or been manipulated through its environment. Q: Why do AI agents create new risk in non-human identity management? A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts. Q: How do security teams know if AI governance is working? A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. Practitioner guidance Instrument agent decision paths Log tool selection, context switches, API calls, and action ordering so the team can reconstruct what the agent actually did during each task. Govern whole workflows, not prompts Review the complete task chain for each deployed agent and define acceptable behaviour at the workflow level instead of at the input field level. Scope agent access to task intent Limit which systems and data sources an agent can reach during a specific workflow, and remove any access that is not required for that task. Bottom line: AI agents create governance gaps when security teams focus on prompts instead of runtime behaviour, tool chaining, and context changes. Explore furtherView Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →

Runtime autonomy collapses the assumption that access can be reviewed after the fact: access review processes were designed for privileges that persist long enough to be observed, certified, and revoked on a cycle. That assumption fails when an agent can acquire, chain, and release access inside a single task. The implication is not that reviews disappear, but that the governance model has to move closer to issuance and execution.

A few things that frame the scale:

88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.

A question worth separating out:

Q: What should teams do when AI-driven agents start calling APIs directly?

A: Give those agents explicit machine identities, narrow scopes, and policy conditions that match the task. Do not assume a human session is present to supervise access. If the API cannot distinguish agent-driven calls from ordinary service calls, it will be easy to overgrant privilege or miss misuse across repeated automated actions.

👉 Read our full editorial: AI agent governance gaps are leaving security teams blind

12/06/2026 9:37 am

AI governance is now an identity governance problem, not a sidecar policy issue. The article shows that AI tools are entering enterprise workflows faster than visibility and enforcement can keep up. That pushes AI from a security awareness concern into the centre of IAM, IGA, and NHI oversight. Practitioners should treat AI access as part of the identity estate, because unmanaged use creates real governance blind spots.

A few things that frame the scale:

19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.

A question worth separating out:

Q: When do AI access controls fail in practice?

A: They fail when authorization happens after retrieval, when tool permissions are broad, or when response masking is treated as optional. In those cases the system has already pulled sensitive content into context or invoked a privileged action before policy intervenes. The safest design is source-side enforcement before the model sees the data.

👉 Read our full editorial: AI agent governance is outpacing enterprise IAM controls

AI agent governance gaps: are your controls keeping up?

Deepen Your Knowledge

Subscribe to the NHI & AI Identity Journal

Subscribe to the NHI & AI Identity Journal