Topic starter
02/08/2026 12:05 pm
TL;DR: High-tech teams are shipping AI-native products and agentic workflows faster than governance patterns are being codified, according to Straikerai research that 80% of organisations already see risky AI agent behaviour such as improper data exposure and unauthorized system access. The real control gap is not model novelty alone, but managing tool use, memory, and shadow AI before those capabilities become business-critical.
Editorial analysis by NHI Mgmt Group, based on content published by Straikerai: “How to Secure AI Agents in High-Tech Companies”.
By the numbers:
- 80% of organisations report encountering risky behaviours from AI agents, including improper data exposure and unauthorized system access.
Key questions
Q: What breaks when an AI system has memory and tool access but no clear governance?
A: The organisation loses the ability to prove what the system was allowed to do, why it did it, and whether the action stayed inside policy.
Q: Why do AI agents increase access risk even when they are visible?
A: Because visibility does not reduce privilege on its own.
Q: What are the warning signs that shadow AI is becoming a security problem?
A: Look for AI tools connected outside approved procurement, unexplained API or token usage, and data leaving normal SaaS boundaries.
Practitioner guidance
- Inventory every AI agent and automation Build a living register of coding assistants, chatbots, document analyzers, workflow bots, and internal agents.
- Constrain tool use by policy Require explicit allowlists for database queries, file operations, code execution, and workflow triggers.
- Separate experimentation from production access Use isolated sandboxes for agent trials, especially where tools can reach sensitive data or operational systems.
Bottom line: AI agents create a governance gap when legitimate tool access can be manipulated into unauthorised action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:10 pm
Tool access is the new trust boundary for AI agents: once an agent can query data, call APIs, or trigger workflows, security has shifted from model safety to action governance. That means the decisive question is not what the model says, but what the agent is allowed to do with delegated permissions. Practitioners should treat tool authorisation as the core control plane for agentic systems.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: High-tech AI agents need governance for tool misuse and shadow AI