Topic starter
25/06/2026 3:05 pm
TL;DR: AI safety and AI security need to converge, because agent autonomy changes both the control questions and the failure modes that traditional shift-left security was built to answer, according to Zenity. The separation between model alignment and operational security is no longer workable when agents make runtime decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Bridging AI Safety and AI Security: Reflections from the NYC AI Safety Meetup”.
Key questions
Q: How should security teams govern AI agents that can change actions at runtime?
A: Security teams should govern runtime AI by correlating identity, data, and intent before trusting an action path.
Q: Why do safety controls and security controls both matter for AI agents?
A: Safety controls address whether the agent behaves in ways that remain trustworthy and aligned, while security controls address whether the agent can be attacked, misused, or pushed off course.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Define a joint safety-security control model Map which agent behaviours are evaluated for alignment, which are monitored for misuse, and which are escalated as security events.
- Treat agent decision paths as governed evidence Capture the sequence of prompts, tool calls, and action choices that led to a material outcome.
- Separate runtime discretion from fixed automation Inventory which AI systems can choose actions at runtime and which only execute predetermined workflows.
Bottom line: AI agent governance cannot be split cleanly between safety and security once the actor can make runtime decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:23 pm
AI agent governance fails when safety and security are treated as separate disciplines. The article's central point is that neither alignment work nor operational security is sufficient on its own once an agent can act in the environment. Safety explains whether the behaviour is acceptable, while security explains whether the behaviour can be trusted under pressure. Practitioners need to stop treating those as parallel programmes and start treating them as one control surface.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What should organisations do when AI agent autonomy and secure by design conflict?
A: They should treat autonomy as a governance constraint, not just a product feature. The practical test is whether the organisation can explain, monitor, and challenge the agent's decisions without relying on assumptions that only work for fixed workflows. If it cannot, the programme needs a stronger control model before wider deployment.
👉 Read our full editorial: AI agent security needs safety inputs to become secure by design