Notifications
Clear all
Topic starter
20/08/2026 6:09 pm
TL;DR: AI agents are moving from experimentation to operational use, but the governance gap is widening as organisations face generative AI misuse, safety concerns, and regulatory pressure, according to ActiveFence. The core issue is that AI capability is advancing faster than the controls needed to govern agent behaviour, data access, and accountability.
NHIMG editorial — based on content published by ActiveFence: Here's what our experts are saying about 2025
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: How do organizations prove AI agent controls are actually working?
A: Organizations prove control effectiveness by showing which agents accessed which data, what actions they executed, and whether those actions stayed within approved task boundaries.
Practitioner guidance
- Define AI agent ownership and approval paths Assign a named business and technical owner to every agent that can access internal systems, then require approval before new tools or data sources are added.
- Scope agent credentials to the smallest viable tool set Issue separate credentials or tokens per agent function, per environment, and per data boundary.
- Log runtime agent actions at investigation quality Capture tool calls, data access, policy decisions, and identity context in a form security and compliance teams can query later.
What's in the full article
ActiveFence's full blog covers the operational detail this post intentionally leaves for the source:
- Expert commentary on how trust and safety teams are prioritising child safety, generative AI, and regulation in 2025
- Role-based perspectives on legal, geopolitical, and cybersecurity pressures that shape platform governance
- The specific threat trends and business implications behind each 2025 prediction
- Context on how the vendor's experts expect AI misuse and safety challenges to evolve through the year
👉 Read ActiveFence's analysis of the trust, safety, and AI security trends shaping 2025 →
AI agent security in 2025: what risks and controls matter most?
Explore further
20/08/2026 6:45 pm
AI agent identity is now a governance category, not an implementation detail. Once an agent can choose actions at runtime, it behaves like a dynamic non-human identity rather than a fixed application account. That means access policy, lifecycle control, and behavioural oversight must be designed together. Organisations that keep treating agents as ordinary automation will miss the governance shift. Practitioners should formalise AI agent identity ownership now.
A question worth separating out:
Q: Who is accountable when an AI agent exposes credentials or changes identity state?
A: Accountability should sit with the business owner of the agent, the identity team that granted scope, and the control owner responsible for the affected workflow. If the agent touched privileged systems, incident handling should follow the same seriousness as any privileged access failure, because the issue is not just misuse but governance collapse across the identity layer.
👉 Read our full editorial: AI agent risk and regulatory pressure define 2025 security priorities
