Topic starter
02/08/2026 9:47 am
TL;DR: AI agents can move sensitive data across tools at machine speed and inherit broad user permissions, according to Cyberhaven. Endpoint DLP and IAM need runtime visibility because post-event review cannot contain actions that finish before review begins.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “How to Secure AI Agents in the Enterprise: A Practical Guide for CISOs”.
Key questions
Q: Why do AI agents make traditional DLP less effective as a primary control?
A: Traditional DLP is reactive because it monitors data after an access decision has already happened.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Q: What breaks when AI agent governance is treated as access control?
A: The control boundary breaks first.
Practitioner guidance
- Map data lineage across agent workflows Trace where sensitive data is touched, copied, summarised, indexed, or forwarded across endpoints and connected tools so you can see the full action chain.
- Inventory AI agents and inherited permissions Identify every agent running on endpoints or in local environments, then record which human permissions each one inherits and where those permissions exceed the task scope.
- Move guardrails to runtime enforcement Use behavioural context, not only pre-authorised access lists, to decide when an agent is approaching an approved boundary or creating a new exposure path.
Bottom line: AI agent governance fails when security teams rely on controls that were built for slower human behaviour and post-event review.
Glossary terms: Data Lineage, Runtime Guardrail, Inherited Permissions, Endpoint DLP
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:39 pm
AI agent governance fails when visibility arrives after runtime behaviour. The article exposes a basic timing mismatch: security teams are still relying on controls that assume they can inspect access after the fact, while agents can move data, create context, and cross boundaries before the review cycle starts. The practical conclusion is that governance must shift to issuance-time and runtime observation, because post-event review no longer captures the full exposure window.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise discovery or runtime enforcement first for AI governance?
A: Discovery comes first because runtime enforcement cannot be meaningfully scoped without knowing where AI exists and what it can access. Once the inventory is live, teams can apply policy checks, output controls, and retention requirements to the highest-risk systems first.
👉 Read our full editorial: AI agent governance fails when data visibility lags runtime behavior