Topic starter
02/08/2026 12:06 pm
TL;DR: AI systems now blend models, tools, and autonomous workflows, so teams need identity-aware controls rather than model-only scanning. Protect AI and Akto target different layers of AI security, with one centered on model security across the lifecycle and the other on agent and MCP discovery, guardrails, and runtime protection, according to Akto.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “Protect AI: Key Features, Security Capabilities & Essential Tools”.
Key questions
Q: What breaks when AI security stops at model scanning?
A: Model scanning helps identify tampering and unsafe dependencies before deployment, but it does not address runtime misuse.
Q: When should security teams prioritise runtime agent controls over model testing?
A: Prioritise runtime controls when the AI system can call tools, reach APIs, or make execution choices after deployment.
Q: What are the signs that an autonomous agent is operating outside its intended boundary?
A: Look for agents running with approval prompts disabled, outbound connections to unfamiliar destinations, and access to production-classified systems that the workflow does not require.
Practitioner guidance
- Inventory agentic runtime surfaces Map every AI agent, MCP connector, API endpoint, and shadow workflow so you know which identities can act at runtime.
- Separate model and runtime approvals Use one control path for model selection and testing, and a different control path for live agent permissions, tool access, and execution scope.
- Bind guardrails to least privilege Set agent guardrails around data masking, tool use, and permitted actions so runtime behaviour stays inside the smallest workable scope.
Bottom line: AI security now has two distinct jobs: proving the model is safe and governing the agent once it is live.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:11 pm
AI security governance is splitting into two control planes: model assurance and runtime authority are no longer the same problem. A model can be scanned, tested, and approved while the deployed agent still has unsafe access to tools, data, and downstream services. The governance implication is that AI programmes now need separate control ownership for artefact security and operational identity.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do runtime controls change governance for agentic AI?
A: Runtime controls move governance from static inventory management to decision-time enforcement. That means policy, logging, and escalation rules must apply when the agent is about to act, not just when the system is deployed. The practical result is tighter control over trust inheritance, tool use, and unintended action paths.
👉 Read our full editorial: Protect AI vs Akto: what AI security governance actually changes