Notifications
Clear all
Topic starter
02/09/2026 3:57 pm
TL;DR: AI agents are becoming mainstream, with 73% of enterprises expected to adopt them by 2026, but autonomy creates a governance gap because continuous operation and multi-system access outstrip one-time authorisation models, according to SecureAuth. The practical issue is not just access control, but whether identity, policy, and blast-radius limits can keep pace with runtime decision-making.
NHIMG editorial — based on content published by SecureAuth: agentic AI security and the identity foundation for trusted AI
By the numbers:
Questions worth separating out
Q: How should security teams govern AI agents that can choose tools at runtime?
A: Security teams should govern runtime agent choice as an access event, not as a simple application action.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Practitioner guidance
- Define each agent as a governed identity Assign a verified identity, explicit trust level, and bounded capabilities to every production agent so access can be traced back to a single runtime subject.
- Move from one-time approval to continuous checks Evaluate every consequential agent action against current policy, context, and risk instead of relying on a session-start authorisation decision.
- Constrain cross-system reach Limit each agent to the minimum set of databases, APIs, and external services needed for the task, and separate write access from read access wherever possible.
What's in the full article
SecureAuth's full article covers the operational detail this post intentionally leaves for the source:
- The identity foundation and control model behind SecureAuth's Continuous Authority approach for AI agents.
- How the agent authority framework maps identity, authorization, and containment into a single runtime model.
- Product-specific deployment considerations for teams evaluating continuous governance for autonomous workloads.
- Platform positioning and packaging details that matter once you move from analysis to implementation.
👉 Read SecureAuth's analysis of the identity controls needed for agentic AI →
AI agent governance: what changes when autonomy enters IAM?
Explore further
02/09/2026 3:58 pm
Autonomous AI agents collapse the assumption that access is knowable at provisioning time. Traditional NHI governance assumes the actor’s likely use path is stable enough to define privileges in advance. That assumption fails when an agent can select tools and sequence actions at runtime, because intent becomes a moving target. The implication is that least privilege for agents cannot be designed as a static entitlement model.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do organizations prove AI agent controls are actually working?
A: Organizations prove control effectiveness by showing which agents accessed which data, what actions they executed, and whether those actions stayed within approved task boundaries. Useful evidence includes logs, policy decisions, anomaly alerts, and review records. Without that chain, governance is mostly declarative.
👉 Read our full editorial: Agentic AI security depends on continuous identity and authorization
