Topic starter
06/09/2026 9:33 am
TL;DR: AI agents now do real work inside enterprises, but governance, liability, and runtime controls are still unsettled, according to FireCompass. Senior security leaders in a FireCompass roundtable said the core problem is assumption collapse: controls built for human-paced review, stable intent, and predictable outputs do not hold when agents act at machine speed and can repeat mistakes thousands of times.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “AI Agents Are Doing Real Work. Governing Them Is the Unsolved Problem”.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents create liability even when a vendor says the model acted autonomously?
A: Because the deploying organisation still selects the use case, grants the access, and operates the environment where the agent acts.
Q: What are the signs that an AI agent access model is becoming too permissive?
A: Warning signs include agents routinely reaching data outside their intended task, repeated approval exceptions, broad retrieval paths across unrelated systems, and outputs that expose information the user did not explicitly need.
Practitioner guidance
- Treat each AI agent as a governed identity Assign a unique identity to every agent, scope access to a single approved purpose, and require an owner who can answer for its behaviour.
- Move controls to runtime authorisation Enforce permissions at the moment the agent attempts a tool call or destructive action, rather than assuming a pre-approved workflow stays safe.
- Build a live agent inventory Track which agents exist, who approved them, what they can access, and whether they can create additional agents or new execution paths.
Bottom line: AI agent governance fails when organisations rely on human review cycles to control actors that can decide and act at machine speed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 9:34 am
AI agent governance is an identity problem before it is an AI policy problem: The control failure is not that organisations lack opinions about AI, but that they do not yet govern agents as runtime identities with bounded authority. Human-style review, stable intent assumptions, and output checking were built for actors that wait to be inspected. The implication is that identity governance must shift to the moment of execution, not the moment of provisioning.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations compare human access controls with AI agent controls?
A: Human controls rely on judgment, training, and periodic review. AI agent controls need explicit action boundaries, continuous monitoring, and fast containment because the system can act without human interpretation in the loop. The difference is not just speed, but the loss of a stable human decision-maker inside the process.
👉 Read our full editorial: AI agent governance is an unsolved identity problem