Topic starter
14/05/2026 6:53 pm
TL;DR: Clarity Security says AI governance is already lagging because 63% of organisations lack formal AI governance policies and department-led AI integrations are creating non-human identities outside IT oversight; the core problem is inventory, not model policy. Governance breaks when teams cannot account for who provisioned access, what the identity can reach, and when it should be removed.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “Who Governs AI? Why Identity Governance Should Come Before AI Adoption”.
By the numbers:
- 63% of organisations lack formal AI governance policies, according to IBM’s Cost of a Data Breach report.
- The average enterprise has a 144:1 ratio of non-human to human identities, according to Clarity Security.
- 97% of organisations that reported an AI-related breach lacked proper AI access controls at the time of the incident, according to Clarity Security.
Key questions
Q: What breaks when an AI agent is not part of identity inventory?
A: When an AI agent is not part of identity inventory, governance breaks at the point of discovery.
Q: Why do AI infrastructure programmes create new identity governance risk?
A: They create risk because machine-speed workflows can combine APIs, secrets, and delegated authority faster than conventional review cycles can observe.
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement.
Practitioner guidance
- Build a complete AI-connected identity inventory Discover every AI tool, service account, OAuth app, token, bot, and delegated integration that can touch business systems, including department-owned deployments outside IT.
- Assign named ownership to every non-human identity Record a responsible owner for each AI integration so access review, exception handling, and revocation do not depend on informal team memory.
- Remove standing access from dormant AI integrations Identify AI-connected identities tied to pilots, experiments, or unused workflows and disable those that no longer serve a valid business purpose.
Bottom line: AI governance fails when organisations cannot inventory the non-human identities created by departmental AI integrations and shadow adoption.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- How the Clarity non-human identity suite inventories service accounts, OAuth apps, AI agents, API tokens, and bots in one view
- How ownership assignment and risk assessment are applied to specific NHIs after discovery
- How the article frames board and examiner questions about AI-connected access
- How the vendor positions continuous visibility as the basis for audit-ready identity governance
👉 Read Clarity Security's analysis of AI governance and missing NHI inventory →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/05/2026 6:54 pm
AI governance fails first as an inventory failure, not a policy failure. Formal policies matter only after an organisation can enumerate the identities actually touching its environment. When departments can connect AI tools directly to business systems, the governance programme loses sight of the access boundary itself. The practitioner conclusion is simple: no inventory means no governance.
Shadow AI adoption is becoming a lifecycle problem before it becomes a model-risk problem. Once departments can connect AI tools directly to business systems, the governance challenge shifts to discovery, ownership, and revocation. Security teams should assume that every new integration can create a non-human identity that will outlive the pilot that introduced it.
A question worth separating out:
Q: Should organisations treat agentic AI access differently from service account access?
A: Yes. Service accounts are usually persistent and can be managed through lifecycle controls, while agentic AI access is often ephemeral, runtime-selected, and initiated on demand. The right governance model is different because the identity behaviour is different. Treating both as the same class leads to control gaps and delayed policy decisions.
👉 Read our full editorial: AI governance fails when non-human identity inventory is missing