Topic starter
06/11/2026 6:39 pm
TL;DR: Most enterprises cannot answer basic questions about their AI agents because the stack was never built to track ownership, access, intent drift or per-agent cost, and first scans often find five to eight times more agents than expected, according to Aizome. The control gap is not visibility alone; it is governed identity, accountability and runtime oversight for agents that keep acting after their builders are gone.
Editorial analysis by NHI Mgmt Group, based on content published by Aizome: “Five Questions Every CIO Should Be Able to Answer About Their AI Agents”.
Key questions
Q: How should teams inventory AI agents that are built outside central IT?
A: Teams should record every externally built AI agent as a governed identity subject with an owner, intended purpose, tool list, data sources, model version, and approval path.
Q: Why do AI systems create accountability gaps in security programmes?
A: AI systems often combine automated access, opaque transformations, and distributed tooling, which makes it hard to reconstruct who did what.
Q: What is the difference between AI governance and AI runtime security?
A: AI governance focuses on policies, documentation, approvals, fairness checks, and regulatory evidence.
Practitioner guidance
- Build a complete AI agent inventory Track every agent that can reach enterprise systems, including business-built agents, SaaS-activated agents and agents created outside central IT.
- Assign named human ownership Require each agent to have a current accountable owner who can approve changes, attest purpose and answer for the agent's actions.
- Separate approved access from live behaviour Review whether the actions an agent takes still match its declared purpose, not just whether the original access request was approved.
Bottom line: Enterprise AI agents create an identity governance problem because they can be deployed outside IT and continue operating without a clear control owner.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
AI agents have become shadow identities before most organisations have built the controls to govern them. The practical problem is not that agents exist, but that they are being created faster than inventory, ownership and oversight processes can absorb them. When a business unit can stand up an agent with enterprise access outside IT, the security programme is already behind. The implication is that identity governance now has to treat agent registration as a control boundary, not an administrative afterthought.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the best way to control AI agent spend without losing oversight?
A: The best way is to tie spend controls to the agent’s identity, not just its project budget. Set per-agent limits on API usage, tool calls, token consumption, and approved destinations, then route activity through logging, anomaly detection, and human approval for exceptions. That preserves oversight while preventing uncontrolled runtime spend.
👉 Read our full editorial: CIO governance gaps leave enterprise AI agents unaccounted for