Topic starter
20/08/2026 5:48 pm
TL;DR: Broad permissions, nested suppliers, and delayed review cycles let agentic AI turn old RBAC and API gaps into live impact, according to ActiveFence. Runtime action needs tighter identity, privilege, and traceability controls than annual governance can provide.
Editorial analysis by NHI Mgmt Group, based on content published by ActiveFence: “Alice at Hacker Summer Camp: Black Hat 2025 Key Takeaways”.
Key questions
Q: Why do agentic AI workflows increase risk when RBAC and API permissions are broad?
A: Because the agent can turn broad standing access into immediate impact.
Q: What are the warning signs that GenAI governance is failing in production?
A: Common signs include rising token spend without clear business growth, poor traceability of prompt flows, inconsistent routing between models, and backend services that still contain long-lived API keys.
Q: What breaks when agentic AI is governed only as a data platform problem?
A: The control model breaks because data governance does not answer who or what is acting on the data at runtime.
Practitioner guidance
- Implement runtime authorisation for agent actions Constrain every high-risk tool call to explicit, context-aware approval conditions so the agent cannot exceed its intended task scope.
- Inventory third- and fourth-party AI dependencies Map where suppliers, sub-processors, and embedded AI services can alter data flows, permissions, or response paths without direct notice.
- Move threat modelling into delivery pipelines Re-run AI threat models whenever prompts, tools, policies, or integrations change, not only at design sign-off.
Bottom line: Agentic AI shifts the core security problem from what models say to what connected systems can do on their behalf.
Glossary terms: Agentic AI, Fourth-party risk, Runtime Authorisation, Continuous Threat Modeling
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
20/08/2026 6:28 pm
Continuous threat modelling is now the organising principle for agentic AI governance. The article’s strongest point is not that AI creates new risks, but that agentic systems compress the time between decision, tool use, and impact. That makes annual or even quarterly review cycles structurally too slow for the problem. The field should treat runtime modelling as a governance discipline, not an optional testing enhancement. Practitioners should assume that the relevant control boundary is moving as quickly as the agent itself.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when a supplier’s AI use creates fourth-party risk?
A: They should extend due diligence beyond the direct vendor and ask how downstream AI services affect authentication, data handling, logging, and incident response. The practical test is whether the enterprise can still trace and revoke access if a hidden dependency changes behaviour. If not, supplier assurance is incomplete.
👉 Read our full editorial: Agentic AI security now hinges on continuous threat modelling