Notifications
Clear all
Topic starter
10/07/2026 9:21 pm
TL;DR: McKinsey’s 2026 AI Trust Maturity Survey found two-thirds of organisations are experimenting with AI agents, but fewer than one in four have scaled them to production because trust, security, and risk concerns remain the main barrier. The operational bottleneck is no longer model capability, but governance, permissions, and auditable control across agent actions.
NHIMG editorial — based on content published by Drata: Trust is the new bottleneck for AI and company-building
By the numbers:
- McKinsey’s 2026 AI Trust Maturity Survey found that while two-thirds of organisations are experimenting with AI agents, fewer than one in four have managed to scale them to production.
- Stripe saw 700+ AI-agent companies launch on its platform in a single year.
- The article cites Hemant Taneja’s Q1 2026 review, which says the new constraint for company-building is trust.
Questions worth separating out
Q: How should security teams govern AI agents that can take actions on their own?
A: Security teams should govern AI agents as machine identities with explicit owners, narrow entitlements, runtime policy checks, and immutable audit trails.
Q: Why do AI agents create problems for traditional IAM and audit processes?
A: Traditional IAM assumes identities are relatively stable and that access can be reviewed after use.
Q: What breaks when AI agent permissions are not tightly scoped?
A: When agent permissions are too broad, the agent can drift from the task it was meant to perform into configuration changes, data access, or privilege changes that were never intended.
Practitioner guidance
- Define agent identities explicitly Assign each AI agent a unique identity, scoped entitlements, and an accountable owner before it can access production systems or customer data.
- Enforce runtime policy checks Require every privileged agent action to pass policy validation at execution time, not after the fact, so drift is blocked before it propagates.
- Instrument immutable action logging Capture who or what the agent was, what tool it called, what data it touched, and what outcome it produced in logs that support audit and incident review.
What's in the full article
Drata's full article covers the operational detail this post intentionally leaves for the source:
- How Drata positions trust centres, compliance automation, and assurance workflows in an agentic operating model.
- The operational story behind continuous proof, audit readiness, and control monitoring for AI-driven systems.
- The specific enterprise use cases Drata highlights for regulated environments such as healthcare, finance, and education.
- The product and workflow detail behind its trust infrastructure layer for agent action verification.
👉 Read Drata's analysis of AI agent trust, governance, and compliance →
AI agent trust and governance: what are teams missing?
Explore further
10/07/2026 9:44 pm
AI agent trust is becoming the new identity control plane. The article is right to frame trust as the scarce resource, because the hard problem is not model intelligence but governable machine action. Once agents can access systems and change state, identity governance must extend from human users to software decision-makers. Practitioners should treat agent identity as a first-class control domain, not a side effect of AI deployment.
A question worth separating out:
Q: Who is accountable when an AI agent causes a security or compliance issue?
A: Accountability should sit with the business owner of the agent workflow, the security team that approved the control model, and the platform team that enforced runtime policy. If those responsibilities are not assigned up front, organisations will struggle to explain why the agent was allowed to act and how its behaviour was verified.
👉 Read our full editorial: AI agent trust is becoming the control plane for enterprise scale
