Notifications
Clear all
Topic starter
10/07/2026 9:22 pm
TL;DR: AI agent questions are climbing fast in procurement traffic across Drata’s Trust Graph, with buyers asking who owns agents, what they can access, how they are monitored, and what proof exists, according to Drata. The data suggests AI agent governance posture is becoming a fourth trust dimension, and existing IAM, TPRM, and audit models do not cover it cleanly.
NHIMG editorial — based on content published by Drata: AI agent governance is becoming a new procurement trust dimension
Questions worth separating out
Q: How should security teams govern AI agents that inherit human access?
A: They should treat inherited access as provisional, not authoritative.
Q: Why do AI agents create problems for existing IAM and TPRM models?
A: Because those models assume the identity being reviewed is stable enough to inspect after the fact.
Q: What do organisations get wrong about AI agent governance evidence?
A: They often treat evidence as a by-product of compliance rather than a control requirement.
Practitioner guidance
- Build a live agent inventory Track every AI agent, its business owner, spawning identity, connected tools, and current scope in one place so security and procurement can answer ownership questions consistently.
- Separate agent approval from runtime validation Treat initial approval as only the start of governance.
- Attach evidence to the agent identity record Preserve logs, policy decisions, and authorisation context alongside the agent record so audit and buyer questionnaires can be answered without manual reconstruction.
What's in the full article
Drata's full article covers the operational detail this post intentionally leaves for the source:
- How the Trust Graph classifies AI questionnaire traffic and groups recurring buyer concerns.
- The five-question framework in the order Drata observed it across customer procurement activity.
- The four trust dimensions model, including how AI Agent Governance Posture differs from TPRM.
- The EU AI Act mapping Drata uses to connect procurement expectations to upcoming obligations.
👉 Read Drata's analysis of the five questions shaping AI agent governance →
AI agent governance posture: what procurement is asking for now?
Explore further
10/07/2026 9:45 pm
AI agent governance posture is becoming a distinct trust surface, not a subset of TPRM. The article correctly separates vendor risk assessment from the agents running inside the seller's own environment. That distinction matters because the buyer is no longer only judging whether a vendor is trustworthy, but whether the vendor can prove control over the autonomous or semi-autonomous identities it has spawned. Practitioners should treat this as a new governance category, not a questionnaire add-on.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who should be accountable for AI agent behaviour when buyers ask for proof?
A: Accountability should sit with the business owner of the agent, backed by security and IAM teams that can prove identity, scope, and monitoring. If ownership is vague, the organisation will struggle to satisfy procurement and audit. Clear accountability is what turns agent governance from a concept into an operational control.
👉 Read our full editorial: AI agent governance is becoming a new procurement trust dimension
