Notifications
Clear all
Topic starter
18/08/2026 2:53 pm
TL;DR: AI agent adoption is accelerating while governance lags, with 98% of companies planning more agents in 12 months and 80% already reporting actions beyond intended scope, according to Braintrust and SailPoint's research. The practical issue is not framework choice alone but whether orchestration, tracing, and policy controls are strong enough to govern planning, tool use, memory, and multi-step execution.
NHIMG editorial — based on content published by Braintrust: How to build an AI agent: the best tools to use in 2026
Questions worth separating out
Q: How should security teams govern AI agents that can choose tools at runtime?
A: Security teams should govern runtime agent choice as an access event, not as a simple application action.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when teams cannot trace what an AI agent did?
A: Governance breaks first, because teams lose the evidence needed to decide whether the issue was behavior, identity, or control.
Practitioner guidance
- Define agent permission boundaries before framework selection Document which tools, datasets, and APIs each agent may access, and require explicit approval for any action that crosses those boundaries.
- Treat agent memory as governed state Classify persistent memory, checkpoints, and session data as security-relevant assets.
- Require end-to-end tracing before production release Make trace capture mandatory for tool calls, model turns, handoffs, retries, and human approvals.
What's in the full article
Braintrust's full article covers the implementation detail this post intentionally leaves for the source:
- Language-by-language framework selection guidance for Python, TypeScript, and .NET teams
- Implementation trade-offs for graph-based orchestration versus role-based coordination
- Tracing, evaluation, and release-control mechanics across each framework
- Operational differences between durable state, handoffs, and multi-agent workflows
👉 Read Braintrust's analysis of the best AI agent tools to use in 2026 →
AI agent frameworks and the governance gap teams are missing?
Explore further
18/08/2026 3:36 pm
AI agent frameworks are becoming identity infrastructure by another name. Once an agent can hold state, call tools, and act across multiple steps, it behaves like a governed non-human identity rather than a simple application component. That means access scope, auditability, and lifecycle control matter as much as orchestration elegance. The security lesson is that teams must treat agent frameworks as part of IAM and PAM design, not only as developer tooling.
A question worth separating out:
Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?
A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.
👉 Read our full editorial: AI agent frameworks are exposing new governance gaps in 2026
