Notifications
Clear all
Topic starter
10/06/2026 11:33 pm
TL;DR: Gartner projects AI governance spending will reach $492 million in 2028 and exceed $1 billion by 2030, while regulation is expected to extend to 70% of global economies by decade end, underscoring the gap between visibility and runtime control according to EnforceAuth. The real issue is that point-in-time audits and policy tracking do not continuously authorize what AI is allowed to do.
NHIMG editorial — based on content published by EnforceAuth: Gartner's AI governance research and the authorization gap analysis
By the numbers:
- Gartner projects that AI governance spending will hit $492 million in 2028 and surpass $1 billion by 2030.
- AI regulation will quadruple, extending to 70% of the world's economies by the end of the decade.
Questions worth separating out
Q: How should security teams implement AI authorization alongside AI governance?
A: Security teams should split the problem into two layers.
Q: Why do point-in-time audits fall short for AI systems?
A: Point-in-time audits only capture a snapshot of access and behaviour, but AI systems can change context between actions.
Q: What do security teams get wrong about AI safety controls?
A: Teams often assume content filters, guardrails, and alignment checks also secure operations.
Practitioner guidance
- Separate governance from enforcement Map inventory, risk, and compliance controls to governance, then document the runtime authorization control that actually blocks or allows each AI action.
- Test for continuous authorization Review each AI workflow for the exact moments where context changes, such as data classification, tool selection, or downstream delegation, and require a fresh authorization decision at those points.
- Move policy into code Store AI authorization logic in version control so teams can review changes, test policy before release, and preserve portability across platform shifts.
What's in the full article
EnforceAuth's full analysis covers the operational detail this post intentionally leaves for the source:
- How the vendor maps authorization across applications, infrastructure, data, and AI workloads in one control model
- The policy-as-code workflow it recommends for versioning, testing, and deploying AI authorization rules
- Specific guidance on evaluating vendor consolidation risk and policy portability during platform selection
- The article's interpretation of Gartner's governance findings and how the vendor positions runtime enforcement against point-in-time audits
👉 Read EnforceAuth's analysis of the AI governance authorization gap →
AI authorization gap: are your controls keeping up with agents?
Explore further
12/06/2026 5:46 am
The authorization gap is the real control failure in AI governance. The article correctly separates observation from enforcement, and that separation now defines the market. Inventory, risk tracking, and compliance reporting tell you what exists, but they do not decide what an AI system may do at runtime. Practitioners should treat runtime authorization as the missing security layer, not an optional enhancement.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Our research also shows that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which is why runtime trust boundaries are becoming harder to defend.
A question worth separating out:
Q: Who is accountable when AI governance fails at runtime?
A: Accountability sits with the team that owns the authorization decision, the policy lifecycle, and the operational controls around AI action. Compliance and model-risk functions may document the posture, but they do not enforce it. If the policy lives as fragile configuration, the organization is accountable for the failure mode created by that design.
👉 Read our full editorial: AI governance spending rises, but the authorization gap remains
