Topic starter
02/08/2026 11:24 am
TL;DR: AI systems that choose tools, access data, and act on behalf of users have outgrown traditional risk management, and Akto’s guide argues for a repeatable framework covering inventory, taxonomy, scoring, mitigation, and continuous reassessment. The real shift is that AI risk is now an identity governance problem as much as a model-risk problem.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “AI Risk Assessment Framework: A Complete Guide for AI Agents, LLMs, and Governance”.
Key questions
Q: What breaks when AI agents are evaluated like ordinary software functions?
A: Function-style tests assume fixed inputs produce fixed outputs, but agents are path-dependent and can choose different tools, memory paths, or timings on each run.
Q: Why do over-scoped AI agent permissions create more risk than human access in live systems?
A: Because an agent can execute decisions continuously inside one task, a single excessive permission can cascade into multiple system changes before anyone notices.
Q: How do you know if AI risk measurement is working?
A: It is working when model behaviour, drift, exceptions, and control failures are visible after deployment, not just during testing.
Practitioner guidance
- Build a complete AI system inventory Track models, agents, vector stores, prompts, templates, tool integrations, and shadow deployments across cloud, on-prem, and employee devices.
- Classify AI assets by autonomy and exposure Separate low-risk internal assistants from public-facing or regulated-data agents so effort follows actual blast radius and decision scope.
- Score identity and tool risks together Assess broad credentials, shared service accounts, standing access, and connected tools as one combined governance problem.
Bottom line: AI risk assessment now spans identity, authorization, and governance because agentic systems can act across tools and data sources, not just generate outputs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:41 pm
AI risk assessment is now an identity governance control, not a standalone model-risk exercise. The article's core point is that agentic systems create a governance problem around who or what is allowed to act, not just how accurate a model may be. Once tools, data, and actions are in scope, inventory, classification, and review become identity disciplines. The practitioner implication is that AI programmes need the same ownership and lifecycle discipline already expected for NHI governance.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: Which frameworks help align AI data governance with identity controls?
A: NIST Cybersecurity Framework 2.0 is useful for structuring govern, identify and protect functions, while identity teams should extend that thinking to access, lineage and accountability. Where AI data access depends on delegated identities, the governance model should also map to lifecycle and least-privilege controls.
👉 Read our full editorial: AI risk assessment frameworks are now identity governance work