Notifications
Clear all
Topic starter
18/08/2026 2:10 pm
TL;DR: Enterprise AI governance only becomes operational when visibility, control, and accountability are connected through an AI control plane, because many organisations already run agents they cannot fully inventory or prove compliant, according to Fiddler. The hard problem is no longer model capability but enforceable oversight across build, runtime, and outcome metrics, where accountability for agent actions remains unsettled.
NHIMG editorial — based on content published by Fiddler: Governance Is What Lets Enterprises Move Faster on AI
By the numbers:
- 78% of business executives lack strong confidence they could pass an independent AI governance audit within 90 days.
- A $20 billion enterprise with weak governance loses about $70 million a year to preventable oversight.
Questions worth separating out
Q: What breaks when AI agents are managed like ordinary machine identities?
A: What breaks is the assumption that access scope can be fully understood from provisioning data and quarterly review.
Q: Why do AI agents complicate traditional IAM and PAM controls?
A: AI agents complicate IAM and PAM because they can make decisions, chain tools, and act faster than human review cycles can respond.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Inventory agentic workloads before granting production access Build a living inventory of every agent, tool, model, and data source that can execute on behalf of the business.
- Map agent permissions to lifecycle-managed identities Treat each agent as a governed non-human identity with scoped credentials, expiry, and revocation paths.
- Instrument step-level tracing for tool use and data access Capture when an agent calls tools, what data it touches, and which control approved the action.
What's in the full article
Fiddler's full blog covers the operational detail this post intentionally leaves for the source:
- How the AI control plane maps policy to telemetry, enforcement, and auditable governance across the AI lifecycle
- The four-part control loop for defining, implementing, enforcing, and tracking AI controls in production
- How tracing and step-level monitoring support accountability when an agent acts across tools and data
- The distinction between business owner, risk and compliance, and audit responsibilities in agent governance
👉 Read Fiddler's analysis of governance, control planes, and accountability in agentic AI →
Agentic AI governance gaps are the blocker teams keep missing?
Explore further
18/08/2026 3:03 pm
Governance is becoming the control layer for agentic AI, not a compliance wrapper. The article correctly frames visibility, control, and accountability as a sequence, because missing any one of them leaves agent behaviour effectively unmanaged. For identity teams, this means agent permissions cannot be treated as a static deployment concern; they are a governed access model that needs telemetry, review, and revocation paths. The practitioner conclusion is clear: if the control plane cannot prove policy enforcement, governance does not exist in operational terms.
A question worth separating out:
Q: Who should be accountable when an AI agent causes a security incident?
A: Accountability should sit with the human owner, platform team, or business function that granted and operated the agent. The identity may act independently, but governance cannot detach responsibility from the delegation chain. Programs should define ownership, escalation, and remediation paths before deployment so responsibility is clear when the agent's behaviour changes.
👉 Read our full editorial: Governance is the control layer that makes AI adoption scale
