Topic starter
27/06/2026 1:27 pm
TL;DR: AI agents now act across systems, tools, and data, making governance designed for static models insufficient, according to Collibra, as Gartner projects 33% of enterprise software will include agentic AI by 2028 and 15% of day-to-day work decisions will be made autonomously. The real issue is not model output but lifecycle control over what an agent can do, touch, and trigger at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Collibra: “Govern every AI agent across its full lifecycle”.
By the numbers:
- By 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024.
- Gartner predicts that 15% of day-to-day work decisions will be made autonomously by 2028.
Key questions
Q: How should organizations approach the governance of AI agents?
A: Organizations should adopt a governance framework that incorporates continuous visibility, adaptive IAM practices, and stringent policy-based controls.
Q: Why do agentic AI workloads increase governance risk compared with normal model calls?
A: Agentic workloads can chain decisions, retry automatically, and expand context across multiple calls.
Q: What breaks when AI systems are tracked only as model names in a spreadsheet?
A: A model-only list misses the connected tools, APIs, data stores, human approval steps, and deployment changes that determine real risk.
Practitioner guidance
- Build a single agent inventory Record each agent once with its use case, owner, version, approved tools, data dependencies and deployment state so governance follows the full lifecycle.
- Bind tool access to the specific agent version Do not treat tool approval as reusable across agents or deployments; scope access to the agent, version and runtime context that need it.
- Track lifecycle changes as control events Treat creation, version changes, redeployment and retirement as governance moments that require evidence, not just engineering updates.
Bottom line: AI agent governance fails when teams separate models, tools, data and deployment into different control processes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:48 pm
AI agent governance fails when the control plane is fragmented. Collibra's core point is that agents cannot be governed as isolated objects because their real risk emerges from relationships: which tools they can call, which data they can reach, which version is running and who owns the use case. Once those links are split across spreadsheets or disconnected tools, no one can prove the operating state of the estate. Practitioners should treat connected inventory as the baseline governance requirement.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organizations prove AI agent controls are actually working?
A: Organizations prove control effectiveness by showing which agents accessed which data, what actions they executed, and whether those actions stayed within approved task boundaries. Useful evidence includes logs, policy decisions, anomaly alerts, and review records. Without that chain, governance is mostly declarative.
👉 Read our full editorial: AI agent governance needs a full lifecycle operating model