Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: More than half of large organisations already have an AI agent project in motion, and Gartner tracked a 750% surge in AI-agent inquiries between Q2 and Q4 of 2024, according to LEVO, while nearly a third of pilots stall before production because enterprises cannot enforce behavioural guardrails. The operational problem is not agent capability but runtime governance, because access review, policy enforcement, and identity tracking assumptions break once agents chain decisions across tools and systems.
NHIMG editorial — based on content published by LEVO: AI agents and multi-agent workflows create new governance risks across enterprise systems
By the numbers:
- Gartner tracked a 750% surge in AI-agent inquiries between Q2 and Q4 of 2024.
Questions worth separating out
Q: What breaks when AI agents are not governed at runtime?
A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context.
Q: Why do multi-agent AI workflows increase information leakage risk?
A: Because each handoff can widen or drop the original user’s permissions.
Q: What are the signs that AI agent governance is too weak for production use?
A: Weak governance usually shows up as poor visibility into what agents can access, incomplete audit trails, and inconsistent oversight across security, legal, compliance, and operations teams.
Practitioner guidance
- Map agent identity lineage across every workflow Inventory agents, MCP servers, APIs, and memory stores together so you can see where identity, privilege, and data flow intersect across the chain.
- Enforce policy at the workflow level Replace per-agent rules with global controls that define what data may move between agent classes and which actions may not be chained together.
- Trace delegated authority in session logs Record which identity authorised an action, which identity executed it, and how tokens or privileges changed during the session.
What's in the full article
LEVO's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how agent-to-agent trust breaks down across coordinator-worker and peer-to-peer workflows.
- Detailed descriptions of runtime visibility, identity mapping, and policy-as-code enforcement across agent chains.
- Operational guidance on risk scoring, audit trails, and monitoring packs for production AI agent environments.
- The article's examples of how multi-agent failures can lead to fraud, data leakage, and runaway cost growth.
👉 Read LEVO's analysis of governance risks in multi-agent AI workflows →
AI agent workflows and governance gaps teams are missing?
Explore further
06/09/2026 6:21 pm
Agentic governance fails when enterprises treat each agent as an isolated identity. The real control problem is the chain, not the component. Privilege aggregation, transitive trust, and confused deputy behaviour emerge only when agents exchange context and authority across steps, which is why static per-agent policies miss the actual risk surface. The practitioner takeaway is that governance must be designed around workflow-level identity behaviour, not single-agent permissions.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 39% of organisations say their AI agents have accessed unauthorised systems, which means the boundary problem is already operational rather than theoretical.
A question worth separating out:
Q: How should security teams govern agentic AI that can execute IAM tasks?
A: Start by treating the agent as an NHI with bounded authority, explicit ownership, and revocation procedures. Require human approval for high-risk actions, log every decision path, and enforce least privilege at the workflow level. If the agent cannot be audited or rolled back, it is not yet ready for autonomous IAM execution.
👉 Read our full editorial: AI agent governance gaps are widening across multi-agent workflows
