Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: AI agents are moving into production fast, but LEVO argues that nearly 9 out of 10 enterprises expect deployment by 2025 while half of pilot projects stall because security and compliance concerns remain unresolved. The core issue is that static IAM and perimeter controls cannot govern machine-speed, context-driven agent behaviour, so Zero Trust becomes the required model for verification, auditability, and blast-radius control.
NHIMG editorial — based on content published by LEVO: Zero Trust Architecture for AI Agents
By the numbers:
- 9 out of 10 enterprises expect AI agent, I agent deployment by 2025, according to LEVO.
- Zero Trust is already embraced by 63% of organisations, according to LEVO.
Questions worth separating out
Q: What breaks when AI agents inherit access from users and service accounts?
A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern.
Q: Why do AI agents change the way organisations think about zero trust?
A: AI agents can operate continuously, act at machine speed, and influence multiple systems without waiting for a human decision at each step.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Assign unique identities to every AI agent Treat each agent instance as a governed non-human identity with its own credentials, lifecycle, and audit trail rather than sharing tokens across workflows.
- Enforce per-request authorisation for agent actions Apply dynamic policy checks to prompts, API calls, and data access so that each action is evaluated against current context, not just initial provisioning.
- Constrain delegation chains and sub-agent creation Define which agent can spawn another, what it may delegate, and which actions require human review before execution reaches a high-risk boundary.
What's in the full article
LEVO's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step Zero Trust implementation patterns for AI agents across identity, policy, and runtime enforcement.
- Detailed examples of microsegmentation and per-request authorisation used to constrain agent activity.
- The vendor's explanation of how to detect, log, and block shadow agents and risky delegation chains.
- Specific guidance on auditability and compliance controls for regulated AI deployments.
👉 Read LEVO's analysis of Zero Trust for AI agents and identity controls →
AI agent identity risk is exposing the limits of traditional IAM?
Explore further
06/09/2026 5:19 pm
AI agents do not fit the access-review model that IAM teams built for humans. Access review assumes a stable subject with standing entitlements that can be certified on a schedule. That assumption fails when the actor can change scope mid-session, call tools dynamically, and discard privileges after execution. The implication is not just more frequent review, but a different control model for runtime identity.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, and a quarter encountered multiple attacks.
A question worth separating out:
Q: Should organisations prioritise runtime controls or agent productivity first?
A: Security teams should prioritise runtime controls before broad deployment because uncontrolled agent expansion creates compliance and breach risk faster than most programmes can remediate it. The practical sequence is identity, policy, telemetry, then scale. Without that order, productivity gains can quickly become unrecoverable governance debt.
👉 Read our full editorial: Zero Trust for AI agents: why traditional IAM falls short
