Topic starter
16/04/2026 8:28 pm
TL;DR: As AI agents move into production workflows, auditability now depends on both expert evaluation and identity governance, with Descope noting that 88% of identity decision-makers are using or planning to use agents but only 37% have moved beyond pilots. The harder problem is proving who the agent acted for, what it accessed, and whether those access decisions were actually authorised.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Auditing AI Agents From Inception to Deployment”.
Key questions
Q: How should teams prove that an AI agent was authorised to act?
A: Teams should prove authorisation by tying each action to a distinct agent identity, a scoped permission decision, and an audit trail that shows who approved the access and under what conditions.
Q: Why do model evaluations not solve AI agent governance on their own?
A: Model evaluations measure output quality, but governance also needs proof of access, consent, and attribution.
Q: What are the signs that AI agent permissions are too broad in enterprise environments?
A: Common warning signs include agents accessing tools they do not need, performing irreversible actions without confirmation, retrieving cross-tenant or unrelated data, and acting with long-lived credentials.
Practitioner guidance
- Define agent identity as a governed subject Assign each production agent a distinct identity, access scope, and ownership model so it is no longer hidden behind generic infrastructure credentials.
- Replace standing access with task-scoped permissions Use short-lived credentials and narrowly scoped entitlements for agent actions that touch sensitive systems or regulated data.
- Require step-up approval for sensitive agent actions Introduce human-in-the-loop checkpoints for high-risk operations such as financial transactions, record changes, or access escalation.
Bottom line: AI agent governance cannot stop at evaluation, because model quality does not prove authorisation or access control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 8:43 pm
AI agent auditing is now an identity problem before it is a model-evaluation problem. Model scoring can tell teams whether outputs are accurate, but it does not prove who the agent acted for or whether that action was authorised. For agentic systems, the audit question shifts from 'did it work?' to 'did it have the right authority to work at all?' The practitioner conclusion is that evaluation evidence without identity evidence is incomplete.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: What happens when an AI agent is allowed to cross systems without clear delegated authority?
A: When an AI agent crosses systems without clear delegated authority, its permissions can expand beyond the original task, and the receiving system may not know what the agent is allowed to do. That creates gaps in enforcement, auditability, and accountability, especially when the workflow involves clinical decisions, privacy-sensitive data, or time-sensitive care coordination.
👉 Read our full editorial: AI agent auditing needs identity proof, not just model evaluation