Topic starter
16/01/2026 1:59 pm
TL;DR: AI agents now perform actions that can delete files, modify databases, and share sensitive information, so risk rises with autonomy, tool permissions, data access, and supply-chain exposure, according to Noma Security. That makes visibility, runtime guardrails, and lifecycle governance the deciding controls, not simply model choice or employee policy.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Securing agentic ai: a practical framework for enterprise risk management”.
Key questions
Q: What breaks when AI agents can act without a verified human behind them?
A: Fraud and IAM controls lose attribution.
Q: Why does agentic AI increase access risk in enterprise identity programs?
A: Agentic AI increases risk because one agent may move across multiple services to complete a single task.
Q: How do security teams know whether agent guardrails are working?
A: They know guardrails are working when denied tool calls are visible in logs, high-risk paths are blocked consistently, and the agent cannot override policy from inside its own session.
Practitioner guidance
- Map agent autonomy to control tier Distinguish agents that merely assist from agents that can independently select tools and execute actions, then assign different approval and monitoring thresholds to each class.
- Scope tools to task-specific privilege Remove delete, modify, and command-execution capabilities unless the task truly requires them, and separate read-only retrieval from write-capable workflows.
- Inventory every agent and integration Create a live inventory of agents, MCP servers, model endpoints, and third-party tool connections so no execution path remains undocumented.
Bottom line: Agentic AI changes identity governance because autonomous systems can make and execute decisions after access is granted.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:40 pm
Agentic AI turns access governance into execution governance: the core issue is no longer whether a system may authenticate, but what it may decide to do once authenticated. Traditional IAM assumes the actor’s intent is known when access is granted, yet agentic systems can change action sequence at runtime. The implication is that governance must move from static permission assignment to runtime authority containment.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: What should organisations do before deploying AI agents in enterprise workflows?
A: Define the agent’s identity, privilege scope, and accountability before enabling production access. Then add output validation for harmful or non-compliant responses. That sequence gives security, IAM, and compliance teams a clear chain of evidence when the agent touches regulated or customer-facing data.
👉 Read our full editorial: Agentic AI security requires visibility, guardrails, and least privilege