Topic starter
18/08/2026 2:53 pm
TL;DR: AI agent adoption is accelerating while governance lags, with 98% of companies planning more agents in 12 months and 80% already reporting actions beyond intended scope, according to Braintrust and SailPoint's research. The practical issue is not framework choice alone but whether orchestration, tracing, and policy controls are strong enough to govern planning, tool use, memory, and multi-step execution.
Editorial analysis by NHI Mgmt Group, based on content published by Braintrust: “How to build an AI agent: the best tools to use in 2026”.
Key questions
Q: What breaks when AI agents inherit loose human authority?
A: Loose human authority turns agent security into an amplification problem.
Q: Why do conversational AI systems create new identity and access risks?
A: Because they can combine data retrieval, decision-making, and execution in a single interaction.
Q: What are the signs that an AI agent conversation is becoming unsafe?
A: Look for repeated reframing, slow escalation toward sensitive actions, probing for tool access, and requests that narrow from a legitimate task into higher-risk operations.
Practitioner guidance
- Define the agent's authority boundary Document which tools, data sets, and downstream actions each agent may use, then align that scope to a named business task rather than a generic bot role.
- Issue scoped credentials per workflow Use dedicated identities, short-lived credentials, and explicit approval points so one agent run cannot inherit broader access from another.
- Require traces before release Gate deployment on trace coverage that shows tool choice, handoffs, retries, and state transitions for the highest-risk tasks.
Bottom line: AI agent frameworks do not remove governance complexity, they concentrate it in orchestration, state, and tool use.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:36 pm
AI agent frameworks are becoming governance infrastructure, not just developer tooling. The article makes clear that planning, tool use, memory, retries, and multi-step execution are the real operational risks. That means the security question is no longer which framework is easiest to code against, but which one can enforce policy across long-running behaviour. Practitioners should treat agent frameworks as part of the governance stack, not a sidecar to it.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What frameworks should teams use to assess agent orchestration risk?
A: Use NIST AI RMF for governance, OWASP Agentic AI Top 10 for application risk patterns, and MITRE ATLAS for adversarial behaviour. Where agents touch credentials or delegated access, add NHI governance and access lifecycle controls so the orchestration layer is reviewed as part of identity security.
👉 Read our full editorial: AI agent frameworks are exposing new governance gaps in 2026