Topic starter
02/08/2026 9:47 am
TL;DR: AI agents act at machine speed, inherit broad user permissions, and move sensitive data across tools in ways legacy DLP and IAM were not built to observe, according to Cyberhaven. The governing assumption that access can be reviewed after the fact breaks when the actor can execute, propagate context, and create exposure before any review cycle catches up.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “How to Secure AI Agents in the Enterprise: A Practical Guide for CISOs”.
Key questions
Q: What breaks when AI agent governance is treated as access control?
A: The control boundary breaks first.
Q: Why do AI agents make traditional DLP less effective as a primary control?
A: Traditional DLP is reactive because it monitors data after an access decision has already happened.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Map data lineage across agent workflows Trace where sensitive data is touched, copied, summarised, indexed, or forwarded across endpoints and connected tools so you can see the full action chain.
- Inventory AI agents and inherited permissions Identify every agent running on endpoints or in local environments, then record which human permissions each one inherits and where those permissions exceed the task scope.
- Move guardrails to runtime enforcement Use behavioural context, not only pre-authorised access lists, to decide when an agent is approaching an approved boundary or creating a new exposure path.
Bottom line: AI agent governance fails when security teams rely on controls that were built for slower human behaviour and post-event review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:39 pm
AI agent governance fails when visibility arrives after runtime behaviour. The article exposes a basic timing mismatch: security teams are still relying on controls that assume they can inspect access after the fact, while agents can move data, create context, and cross boundaries before the review cycle starts. The practical conclusion is that governance must shift to issuance-time and runtime observation, because post-event review no longer captures the full exposure window.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise discovery or runtime enforcement first for AI governance?
A: Discovery comes first because runtime enforcement cannot be meaningfully scoped without knowing where AI exists and what it can access. Once the inventory is live, teams can apply policy checks, output controls, and retention requirements to the highest-risk systems first.
👉 Read our full editorial: AI agent governance fails when data visibility lags runtime behavior