Topic starter
06/09/2026 6:20 pm
TL;DR: More than half of large organisations already have an AI agent project in motion, and Gartner tracked a 750% surge in AI-agent inquiries between Q2 and Q4 of 2024, according to LEVO, while nearly a third of pilots stall before production because enterprises cannot enforce behavioural guardrails. The operational problem is not agent capability but runtime governance, because access review, policy enforcement, and identity tracking assumptions break once agents chain decisions across tools and systems.
Editorial analysis by NHI Mgmt Group, based on content published by LEVO: “AI Agent Governance: Secure & Scale Multi-Agent Workflows”.
Key questions
Q: What breaks when AI agents are allowed to contain incidents without governance?
A: The response chain becomes difficult to audit and reverse.
Q: Why do multi-agent workflows increase access control risk in production systems?
A: Multi-agent workflows increase risk because one request can fan out into many actions across tools, systems, and sub-agents before a human reviews the outcome.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Map every agent-to-agent handoff Inventory where one agent passes data, instructions or decisions to another, and classify each handoff by sensitivity, privilege and business impact.
- Enforce chain-level policies Define global rules that apply across the whole workflow, including restrictions on PII movement, cross-domain transfers and approval-triggering actions.
- Propagate identity across delegated actions Preserve who authorised the request, which agent executed it and what context was inherited so audit trails reflect the full delegation chain.
Bottom line: Multi-agent AI raises governance risk because authority can accumulate across chained actions even when each step appears individually valid.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:21 pm
Multi-agent workflows turn access control into chain control: the governance unit is no longer the individual agent, it is the full path from request to delegated execution. Local permissions can look safe while the composed workflow becomes overpowered. That is why runtime visibility and chain-level policy enforcement matter more than isolated agent configuration checks.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when an AI agent workflow starts touching PII and high-privilege tools?
A: Apply stricter approval boundaries, separate data retrieval from write actions, and require workflow-level policy enforcement before allowing cross-domain transfers. The risk rises quickly once sensitive data and high-impact tools are combined in the same chain.
👉 Read our full editorial: AI agent governance gaps are widening across multi-agent workflows