Topic starter
10/06/2026 12:00 am
TL;DR: Enterprises are projected to spend $124 million on AI in 2026 while only 21% report mature governance for agentic AI, and 63% now require human validation of agent outputs, according to Cranium’s analysis of KPMG and Deloitte data. The trust gap is no longer theoretical: it is the main constraint on safe AI scale.
Editorial analysis by NHI Mgmt Group, based on content published by Cranium: “The Bridge of Trust: Scaling Enterprise AI in the Era of Autonomous Agents”.
By the numbers:
- Only 21% of companies report having a mature governance model for agentic AI.
- 63% of organizations now require human validation of AI agent outputs.
- AI agents have tripled in the last 18 months.
Key questions
Q: What breaks when AI agents are allowed to contain incidents without governance?
A: The response chain becomes difficult to audit and reverse.
Q: Why do organisations need runtime AI controls instead of relying on human review?
A: Human review is too late if the model or agent can already generate harmful actions, route requests, or trigger downstream changes.
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement.
Practitioner guidance
- Map AI authority boundaries Inventory which models and agents can reach business workflows, external tools, and sensitive data, then document the exact authority each system has in production.
- Separate review from control Use human validation for high-risk outputs, but also define pre-execution constraints that stop unsafe actions before they are issued.
- Track AI supply chain provenance Record model source, training data provenance, vendor dependencies, and testing evidence as part of the AI governance record.
Bottom line: The article describes a widening gap between enterprise AI ambition and governance maturity, which turns AI scale into a trust and control problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/06/2026 2:35 am
Operational trust is the real prerequisite for enterprise AI scale. The article’s central message is not that organisations lack ambition, but that they lack a provable trust model spanning models, agents, and governance workflows. That makes AI scaling an identity and control problem before it is a deployment problem. Practitioners should read this as a signal that governance evidence must be built into the operating model, not appended after rollout.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How can organisations tell whether AI governance is actually working?
A: Look for evidence that every model and agent has an owner, every dependency is recorded, and every high-risk action has a defined approval or containment path. If the organisation can only describe policy in general terms, governance is aspirational. Real control shows up in traceability, monitoring, and documented remediation.
👉 Read our full editorial: AI governance maturity lags behind enterprise scaling plans
11/06/2026 1:35 am
Operational trust is the real prerequisite for enterprise AI scale. The article’s central message is not that organisations lack ambition, but that they lack a provable trust model spanning models, agents, and governance workflows. That makes AI scaling an identity and control problem before it is a deployment problem. Practitioners should read this as a signal that governance evidence must be built into the operating model, not appended after rollout.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How can organisations tell whether AI governance is actually working?
A: Look for evidence that every model and agent has an owner, every dependency is recorded, and every high-risk action has a defined approval or containment path. If the organisation can only describe policy in general terms, governance is aspirational. Real control shows up in traceability, monitoring, and documented remediation.
👉 Read our full editorial: AI governance maturity lags behind enterprise scaling plans
12/06/2026 3:09 am
AI governance maturity is now the limiting control, not AI ambition. The article shows enterprises investing aggressively while mature governance for agentic AI remains rare. That gap matters because adoption can outpace the controls needed to constrain model behaviour, validate outputs, and prove accountability. The practical conclusion is that AI scale is now gated by governance readiness, not executive intent.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams watch for when AI enters security workflows?
A: IAM teams should watch for AI workflows that influence access decisions, exception handling, or review queues without changing the governance model. If the AI is shaping which identities get attention first, the programme needs clear rules for traceability, approval, and escalation before that influence becomes operational default.
👉 Read our full editorial: AI governance maturity lags behind enterprise scaling plans