Topic starter
24/09/2026 1:27 pm
TL;DR: The EU AI Act now requires demonstrable runtime control over what AI systems and agents can access, do, and expose, not just documented governance intent, according to PlainID. That matters because traditional IAM and RBAC do not decide permissions at the moment of action, leaving a gap between policy and enforcement as agentic workflows touch data, tools, and outputs.
NHIMG editorial — based on content published by PlainID: How runtime authorization helps turn EU AI Act requirements into enforceable controls
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams enforce the EU AI Act for AI agents at runtime?
A: Security teams should enforce the EU AI Act by moving control to the moment of action.
Q: Why do IAM and RBAC fall short for agentic AI governance?
A: IAM and RBAC assign access before execution, but agentic AI needs decisions during execution.
Q: What should teams do first when AI agents can access regulated data?
A: Start by inventorying the agent, its tools, its data sources, and its outputs.
Practitioner guidance
- Map AI agent workflows to runtime decision points Identify where prompt intake, retrieval, tool invocation, and output generation occur, then require a policy decision at each point instead of trusting one pre-session grant.
- Separate user clearance from agent capability Document where the human requester is allowed less than the agent can technically reach, then constrain the agent to the user’s purpose and approved resource scope.
- Require step-up for high-risk agent actions Define which actions need human approval, such as sensitive retrieval, financial thresholds, or regulated disclosures, and block execution until the approval condition is met.
What's in the full article
PlainID's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step runtime control mapping across prompt, retrieval, tool use, and output paths
- Capability descriptions for AI and agent discovery, central policy management, and composite identity context
- Implementation guidance for input guardrails, data retrieval guardrails, MCP and API guardrails, and output controls
- Auditability and policy lifecycle patterns for demonstrating enforcement evidence
👉 Read PlainID's analysis of runtime authorization for EU AI Act controls →
EU AI Act runtime controls for AI agents: where IAM falls short?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
24/09/2026 1:27 pm
Runtime authorization is becoming the control layer that separates AI governance intent from enforceable identity policy. The article is right to frame the problem as action-time enforcement rather than policy documentation. For identity teams, that shifts AI governance from advisory review into the same control discipline used for privileged access and sensitive data handling. The practical conclusion is that AI Act readiness is an access-control programme, not just a policy exercise.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement. If auditors can ask for a transaction and receive a complete record in hours, not weeks, the programme is producing usable control evidence rather than just documentation.
👉 Read our full editorial: Runtime authorization for EU AI Act controls in agentic AI
