Topic starter
25/08/2026 6:10 pm
TL;DR: AI-era identity security is moving faster than governance, and Veza cites a CSA survey showing only 26% of organisations have comprehensive AI security policies in place, while the updated OWASP Top 10 for LLM Applications signals a shift toward agent-centric risk. The practical issue is that least privilege and access control must now account for AI agents as governed identities, not just workloads.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Operationalizing the OWASP Top 10 for LLMs: Securing The Identity Control Plane”.
By the numbers:
- Only 26% of organisations report having comprehensive AI security governance policies in place, according to Veza.
- The updated OWASP Top 10 for LLM Applications indicates a significant shift in cybersecurity centered on AI agents, according to Veza.
Key questions
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model.
Q: Why do AI agents make least privilege harder to enforce?
A: AI agents can move across multiple services, make autonomous decisions, and trigger several machine-to-machine actions in one task.
Q: What breaks when AI agent access is reviewed only after the fact?
A: After-the-fact review leaves a gap between action and containment.
Practitioner guidance
- Define agent identity ownership Assign a named business and technical owner for each AI agent identity, including approval authority, access boundaries, and review cadence.
- Bound agent permissions by task Limit AI agent access to the minimum tools, data sets, and systems needed for a specific workflow, rather than reusing broad service access.
- Move reviews to runtime controls Add access monitoring and policy checks that evaluate what an agent can do while it is active, not only what it was allowed to do at setup.
Bottom line: AI agents are now being treated as governed identities, which pushes identity teams into the centre of AI security policy.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 21 hours ago by NHI Mgmt Group
25/08/2026 6:11 pm
AI agent identity governance has become a first-order identity problem, not an adjacent AI risk. Veza’s 26% governance figure is less important than what it reveals about control maturity: most organisations are still treating AI policy as an overlay rather than an identity boundary. Once an agent can act through tools and services, the real question is who governs that actor across its full runtime lifecycle. Practitioners should treat AI agents as governed identities with explicit access scope.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent. If any of those answers require manual reconstruction, governance exists on paper but not in operations.
👉 Read our full editorial: AI agent identity governance is lagging behind security policy
This post was modified 21 hours ago by NHI Mgmt Group