Topic starter
10/07/2026 9:20 pm
TL;DR: Enterprise AI is moving from model governance to action governance as agents access tools, move data and execute workflows in real time, according to OneTrust. That shift makes continuous oversight, runtime guardrails and observability the practical foundation for trusted autonomy, not periodic review.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Agents Governing Agents: the Next Evolution of AI Governance”.
Key questions
Q: How should organisations govern AI voice agents that can take real actions?
A: They should classify the actions the agent can trigger and require stronger controls as the risk increases.
Q: Why do autonomous AI tools complicate traditional governance and access control models?
A: Autonomous AI tools complicate governance because they behave like software systems, yet are often deployed by non-technical users without change control or security review.
Q: What are the signs that AI agent governance is too weak for production use?
A: Weak governance usually shows up as poor visibility into what agents can access, incomplete audit trails, and inconsistent oversight across security, legal, compliance, and operations teams.
Practitioner guidance
- Define runtime policy boundaries for agents Specify which data sources, tools and workflow actions each agent may use, and enforce those limits at execution time rather than only at approval time.
- Treat agents as identity-bearing actors Assign scoped permissions, task boundaries and revocation paths to every production agent so access can be reviewed and removed like any other privileged actor.
- Instrument full agent observability Log tool calls, data touches, approvals and exception paths so security, engineering and compliance teams can reconstruct each agent decision chain.
Bottom line: AI agent governance is moving from static model review to runtime enforcement because agents now access tools, move data and execute workflows inside live enterprise systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:43 pm
Runtime control is becoming the real governance boundary for agentic AI. Static review can describe intent, but it cannot contain action once an agent is live in the workflow. The practical problem is not model quality alone, but whether the system can constrain tool use, data movement and delegated execution in real time. For identity programmes, that makes policy enforcement at runtime the decisive control point.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who should own AI agent governance when identity and access are shared across teams?
A: AI agent governance should sit with identity, security, and platform owners together, because no single team sees the full risk surface. IAM owns the control model, security owns containment and monitoring, and platform teams own the runtime integration. Shared ownership matters because agent risk spans identity, policy, and downstream execution.
👉 Read our full editorial: AI agent governance is shifting from model review to runtime control