Topic starter
18/08/2026 2:47 pm
TL;DR: The Great Agent Hack 2025 showed that observability, multi-agent coordination, and systematic red-teaming are becoming the practical baseline for production agentic AI, according to Holistic AI. The lesson is that governance must move from supervising a model in isolation to controlling the behaviour, traces, and failure modes of interacting agent systems.
Editorial analysis by NHI Mgmt Group, based on content published by Holistic AI: “What We Learned from the Great Agent Hack 2025”.
Key questions
Q: How should security teams govern agentic AI as it moves into production?
A: Security teams should govern agentic AI as a class of non-human identity, not as a generic application feature.
Q: Why do agentic AI systems need human-in-the-loop controls?
A: Human-in-the-loop controls keep high-risk decisions inside a review path while allowing automation to handle routine work.
Q: How do you know whether agent observability is enough?
A: Observability is enough only when the organisation already has real-time policy enforcement at the tool layer.
Practitioner guidance
- Define system-level governance boundaries for agents Map each agent workflow to an explicit control boundary covering tool access, delegation limits, and escalation paths.
- Instrument end-to-end observability for every agent workflow Capture prompts, responses, tool calls, latency, cost, and intermediate steps so you can reconstruct how a decision was made.
- Separate model selection from governance design Allow smaller and larger models to coexist only after you have defined the same oversight standard for each workflow, including approval thresholds and monitoring expectations.
Bottom line: The article shows that agentic AI governance is moving away from isolated model supervision and toward control of the full execution system, including handoffs, traces, and tool use.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:29 pm
System control is the new governance boundary for agentic AI. The article’s central lesson is that supervising a model in isolation is no longer enough once agents interact, call tools, and pass work between steps. Governance has to move to execution traces, delegation paths, and system behaviour because the risk emerges from composition, not just model output. Practitioner conclusion: design controls for the workflow, not the prompt.
A few things that frame the scale:
- 63% of organisations surveyed lacked AI governance policies to manage AI or prevent shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: What should organisations test before adopting agentic AI in security operations?
A: Organisations should test whether the agent can act safely under failure, whether its actions are traceable, and whether an incorrect decision can be rolled back. The key question is not only what the agent can do, but what happens when upstream telemetry is wrong or incomplete. Without that test, automation can spread error faster than humans can correct it.
👉 Read our full editorial: Agentic AI governance is shifting from model control to system control