Topic starter
12/05/2026 8:00 pm
TL;DR: CIS has published three companion guides that map LLMs, AI agents and MCP environments to the CIS Critical Security Controls, centring inventory, deterministic authorisation and NHI governance across model, reasoning and protocol layers, according to Astrix Security. The security assumption is no longer that AI is a separate stack; its actions must be controlled like any other governed identity and tool path.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Securing LLMs, AI Agents, and MCP: Unpacking the New CIS Companion Guides”.
Key questions
Q: What breaks when AI agents are managed like ordinary machine identities?
A: What breaks is the assumption that access scope can be fully understood from provisioning data and quarterly review.
Q: Why do AI agents need deterministic authorisation instead of model output approval?
A: Because model output is a recommendation, not a permission boundary.
Q: What do security teams get wrong about role-based access for MCP?
A: They often assume that coarse roles alone solve the problem.
Practitioner guidance
- Inventory AI systems and their credentials Catalog LLMs, AI agents, MCP clients and servers, plus the service accounts, API keys and OAuth tokens they use.
- Separate suggestion from authorisation Require a deterministic policy check before any model, agent or tool call can read, write or execute against a secured resource.
- Constrain tool access with allowlists Define the exact tools an AI agent or MCP client may invoke, then limit each identity to the minimum operations needed for the task.
Bottom line: AI systems become governance problems as soon as they act through credentials, because access scope rather than model quality determines blast radius.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
12/05/2026 8:01 pm
AI governance now inherits the identity problem, not just the model problem. The article is important because it puts AI security back into the language of deterministic authorisation, inventory and access scope. Once an AI system can act through service accounts, API keys or tokens, the question becomes who or what is actually authorised to do the work. Practitioners should read this as a governance reset: AI adoption succeeds or fails on identity control, not on model sophistication.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations prioritise AI inventory before expanding agent use?
A: Start with the systems, identities and connections that can actually execute actions: models, agents, clients, servers and their credentials. Once that map exists, teams can apply controls to the highest-risk paths first and avoid scaling blind spots into production.
👉 Read our full editorial: CIS companion guides bring ai agents and MCP into CIS controls
This post was modified 7 days ago by NHI Mgmt Group