Topic starter
18/08/2026 2:53 pm
TL;DR: Agent frameworks concentrate governance in orchestration, state, and tool use, because they can widen access across long-running execution, as Braintrust explains. Agents need traceable, revocable control over planning and actions so policy does not break mid-run.
Editorial analysis by NHI Mgmt Group, based on content published by Braintrust: “How to build an AI agent: the best tools to use in 2026”.
Key questions
Q: Why do conversational AI systems create new identity and access risks?
A: Because they can combine data retrieval, decision-making, and execution in a single interaction.
Q: What are the signs that an AI agent conversation is becoming unsafe?
A: Look for repeated reframing, slow escalation toward sensitive actions, probing for tool access, and requests that narrow from a legitimate task into higher-risk operations.
Q: What breaks when AI agents inherit loose human authority?
A: Loose human authority turns agent security into an amplification problem.
Practitioner guidance
- Define the agent's authority boundary Document which tools, data sets, and downstream actions each agent may use, then align that scope to a named business task rather than a generic bot role.
- Issue scoped credentials per workflow Use dedicated identities, short-lived credentials, and explicit approval points so one agent run cannot inherit broader access from another.
- Require traces before release Gate deployment on trace coverage that shows tool choice, handoffs, retries, and state transitions for the highest-risk tasks.
Bottom line: AI agent frameworks do not remove governance complexity, they concentrate it in orchestration, state, and tool use.
Glossary terms: Agent Framework, Deployment Drift, Agentic observability, Non-Human Identity (NHI)
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 11 hours ago by NHI Mgmt Group
18/08/2026 3:36 pm
AI agent frameworks are becoming governance infrastructure, not just developer tooling. The article makes clear that planning, tool use, memory, retries, and multi-step execution are the real operational risks. That means the security question is no longer which framework is easiest to code against, but which one can enforce policy across long-running behaviour. Practitioners should treat agent frameworks as part of the governance stack, not a sidecar to it.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What frameworks should teams use to assess agent orchestration risk?
A: Use NIST AI RMF for governance, OWASP Agentic AI Top 10 for application risk patterns, and MITRE ATLAS for adversarial behaviour. Where agents touch credentials or delegated access, add NHI governance and access lifecycle controls so the orchestration layer is reviewed as part of identity security.
👉 Read our full editorial: Framework choice matters less than agent governance controls
This post was modified 11 hours ago by NHI Mgmt Group