Topic starter
11/06/2026 10:44 pm
TL;DR: AI agents in enterprise environments created risk through inherited permissions, tool invocation, data movement, and runtime behaviour, according to Zenity’s 2025 year-in-review. The governance gap is that traditional IAM and monitoring models were built for stable identities and not for agents that decide and act during execution.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Zenity 2025 Year in Review: Building AI Security for the Enterprise”.
Key questions
Q: What breaks when AI governance does not include interaction-level visibility?
A: Teams lose the ability to prove which account was used, what was prompted, and what action followed.
A: When AI agents connect to enterprise systems without strong governance, they can inherit excessive access, move through sensitive data paths, and amplify mistakes at machine speed.
Q: How can security teams know if agent skill controls are actually working?
A: Look for evidence that skills are inventoried, risk rated, scanned before execution, and tied to a policy manifest or approval record.
Practitioner guidance
- Establish agent runtime guardrails Define which agent actions are allowed at execution time, including data egress, tool use and cross-system operations.
- Inventory every agent-to-tool path Map which agents can reach which tools, APIs, internal services and endpoint sessions, then remove unnecessary connections that expand agent privilege beyond the task.
- Separate visibility from enforcement Use monitoring to explain agent behaviour, but rely on inline controls to stop risky actions before they affect downstream systems.
Bottom line: AI agents create a governance problem that traditional identity models do not fully cover because permissions, tools and data movement converge at runtime.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:03 am
Runtime control is now the governance boundary for AI agents. Visibility into where agents exist is necessary, but it no longer answers the core security question: whether an action should be allowed to complete. Once agents can invoke tools, move data and act on events without a human in the loop, governance has to shift to execution-time enforcement. The practitioner conclusion is straightforward: if policy cannot intervene at runtime, it is not yet governing the agent.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What is the difference between runtime policy enforcement and post-event detection for AI agents?
A: Runtime enforcement stops or constrains the agent before the action lands in a downstream system. Post-event detection only explains what happened after the risk has already materialised, which is useful for investigation but too late for containment in fast-moving agent workflows.
👉 Read our full editorial: AI agent governance moved from visibility to real-time control
This post was modified 1 day ago by NHI Mgmt Group