Topic starter
02/08/2026 12:20 pm
TL;DR: Enterprise AI agent adoption is moving from experimentation into production, with Gartner projecting one-third of enterprise software will include agentic AI by 2028 and at least 15% of day-to-day business decisions will be made autonomously, according to Akto. The governance problem is no longer whether agents will spread, but whether organisations can control scope, accountability, and auditability fast enough.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “The Current State of AI Agents Adoption in Enterprises”.
By the numbers:
- According to Gartner, by 2028 one-third of all enterprise software applications will include some form of agentic AI, up from less than 1% in 2024.
- According to Gartner, at least 15% of day-to-day business decisions will be made autonomously by agents by 2028.
- Akto cites PwC’s 2025 executive survey showing 88% of enterprises plan to increase AI budgets this year because of agentic AI.
Key questions
Q: What breaks when AI agents are given broad enterprise access without tight governance?
A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene.
Q: Why do AI agents create more IAM risk than ordinary developer tools?
A: AI agents can make independent tool calls, chain actions, and authenticate with non-human identities while executing a task.
Q: How can teams tell whether AI access is actually under control?
A: Look for evidence that access is limited by purpose, not just by account.
Practitioner guidance
- Define agent identity and ownership Assign each production agent a named business owner, a technical owner, and a lifecycle record that covers onboarding, scope changes, review, and retirement.
- Scope tool access by task Limit each agent to the minimum tools, data sets, and downstream workflows required for a specific use case, then review those permissions after every material workflow change.
- Require decision provenance logging Capture the prompt, tool call, credential use, approval path, and resulting action so teams can reconstruct what the agent decided and why.
Bottom line: Enterprise AI agents are spreading into production faster than the governance models that should define their scope, owners, and approvals.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:20 pm
Agentic AI governance debt is the new control gap: enterprises are adding agents faster than they are redesigning access, audit, and approval models. That creates a gap between what the system can do and what the organisation can prove it authorised. Practitioners should treat agent deployment as a governance redesign exercise, not a feature rollout.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations decide whether AI agent access belongs in IAM or separate governance?
A: If an AI agent can choose actions, call tools, or move between systems during runtime, it should be governed as a distinct identity class with explicit policy and audit coverage. If it is just a scripted workflow, ordinary machine identity controls may be enough. The decision should follow behaviour, not the label attached to the system.
👉 Read our full editorial: Enterprise AI agent adoption is broad, but governance lags