Notifications
Clear all
Topic starter
02/08/2026 11:22 am
TL;DR: AI agents are being connected to data, tools, and decisions faster than security teams can assess them, and Akto’s guide argues that point controls fail unless they are joined into a program with discovery, ownership, risk management, validation, and operations. The real governance gap is not just detection, but accountable control of delegated identity and autonomous behavior.
NHIMG editorial — based on content published by Akto: AI Agent Security Program: A Complete Enterprise Implementation Guide
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: When does AI governance become an IAM and NHI problem?
A: It becomes an IAM and NHI problem as soon as autonomous systems use credentials, APIs, or delegated access to perform actions.
Q: What breaks when an organisation only uses point controls for AI agents?
A: Point controls can reduce a single risk, but they do not solve ownership, inventory, policy scope, or response.
Practitioner guidance
- Build a live agent inventory Track approved, internal, third-party, and shadow agents in one maintained inventory, including owner, purpose, connected tools, data access, risk tier, and last validation date.
- Require named ownership before production Assign business, technical, and security owners during intake, and block production use until the approval gate records responsibility and risk review.
- Classify agents by exposure and impact Use a risk register to prioritise critical agents that can reach sensitive systems, influence consequential decisions, or expose material data and funds.
What's in the full article
Akto's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step five-pillar operating model for agent discovery, ownership, risk management, validation, and operations
- Maturity model with level-by-level indicators for moving from ad hoc response to operational excellence
- Practical inventory fields for approved, internal, third-party, and shadow agents
- Security review and incident workflow guidance for AI agent governance teams
👉 Read Akto's guide to building an AI agent security program →
AI agent security programs: what IAM teams need to operationalise?
Explore further
02/08/2026 12:40 pm
AI agent security is becoming an identity governance problem before it becomes a tooling problem. The guide is right to move beyond point controls because discovery, ownership, policy, validation, and operations only work when they are treated as one programme. For IAM and NHI teams, the key insight is that an agent with delegated identity is not just another application asset. It is a runtime identity that needs lifecycle control, accountability, and repeatable review.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who should be accountable for AI agent security incidents?
A: Accountability should sit with the team that owns the agent's business function and permission model, not with a single security tool owner. If the organisation cannot name who approved the agent's scope, who can revoke it, and who reviews runtime exceptions, the governance model is incomplete.
👉 Read our full editorial: AI agent security programs turn agent sprawl into governable identity
