Topic starter
04/06/2026 2:56 pm
TL;DR: Single-signal security for agentic AI leaves predictable blind spots across identity, data, model behavior, posture, and environment, according to Zenity. A five-signal runtime view is now the baseline for deciding whether an agent’s activity was appropriate, not merely permitted.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Five Signals, One Answer: Why Single-Signal AI Security Always Fails”.
Key questions
Q: What fails when security tools watch only one signal in agentic AI?
A: Single-signal tools fail because agentic behaviour emerges from the combination of identity, data access, model output, tool use, posture, and environment.
Q: Why does authorised access still leave agentic AI risk unresolved?
A: Because permission does not prove appropriateness.
Q: How do security teams know if agentic AI controls are failing?
A: The main signs are session drift, repeated retry loops, unauthorized tool calls, and behaviour that diverges from the documented task sequence.
Practitioner guidance
- Map the five runtime signals Define how identity, data, model behaviour, posture, and environment will be correlated before any agent is allowed to act on production workflows.
- Separate authorisation from appropriateness Require the control plane to answer whether the action matched task context, not only whether the credential or tool invocation was permitted.
- Build response tiers beyond block or allow Create graded actions such as logging, elevated scrutiny, approval queueing, step blocking, workflow suspension, and kill switch handling.
Bottom line: Single-signal controls are too narrow for agentic AI because they cannot explain whether runtime behaviour was appropriate in context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:05 pm
Single-signal AI security is structurally incomplete. Identity, data, model behaviour, posture, and environment each capture a real slice of risk, but none can prove whether an agent’s action was appropriate on their own. The field’s mistake has been treating partial observability as if it were decision-grade visibility. Practitioners should read this as a governance boundary, not a tuning problem.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when a specific step in an agent workflow is unsafe?
A: They should use a graduated response model that can mutate or block the step without necessarily terminating the entire workflow. The right choice depends on whether a safe equivalent exists, whether the action is reversible, and whether the platform can maintain trajectory-level awareness across the session.
👉 Read our full editorial: Five-signal ai agent security exposes the limits of single controls