Topic starter
02/08/2026 11:25 am
TL;DR: AI agent governance shifts oversight from model outputs to delegated action, because agents can chain tool calls, access systems, and trigger downstream consequences faster than human review can respond, according to Akto’s analysis. The governance problem is no longer documentation alone but runtime control over scope, identity, and accountability.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “AI Agent Governance: Framework, Principles, Risks and Best Practices”.
Key questions
Q: What breaks when agentic AI governance stops at policy approval?
A: Approval-only governance fails because it assumes the important risk is launch-time permission, when the real exposure happens during runtime decisions.
A: SMEs should start with core controls that address their highest risks, then expand as needs grow.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Define runtime approval boundaries for every agent Specify which actions require human confirmation, which are pre-approved, and which are prohibited before the agent is deployed into production workflows.
- Inventory agent identities and credentials Track every service account, token, API key, and delegated permission used by production agents, then bind each one to a named owner and task scope.
- Add continuous monitoring for tool and API usage Watch prompt activity, tool calls, memory access, and outbound API requests so anomalous behaviour can be detected before it becomes a larger incident.
Bottom line: AI agent governance fails when teams treat policy as sufficient and ignore the runtime window in which agents can act.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:42 pm
Policy-led AI governance is already insufficient for agentic systems. The article captures a real governance gap: traditional AI programmes were built to review outputs, not to control actions taken through tools, APIs, and delegated identities. Once an agent can act faster than human review, governance must move into runtime enforcement and lifecycle control. The practitioner conclusion is straightforward: policy without execution control is documentation, not governance.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations separate agent permission checks from human approval checks?
A: Yes. Base permission checks decide whether the agent is allowed to attempt the action at all, while human approval decides whether a sensitive but permitted action should proceed. Mixing those layers creates false trust and makes it harder to explain why an action was allowed, denied, or expired.
👉 Read our full editorial: AI agent governance exposes the gap between policy and runtime control