Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Static AI governance struggles as Shadow AI, model drift, and machine-speed agent actions change faster than annual reviews can track, according to WitnessAI’s analysis. ISO/IEC 42001 and the EU AI Act both point toward continuous monitoring, making runtime evidence and feedback loops the practical basis for defensible AI oversight.
NHIMG editorial — based on content published by WitnessAI: AI governance as continuous improvement
By the numbers:
- 69% of organisations suspect or have evidence that employees use prohibited public generative AI tools.
Questions worth separating out
Q: What breaks when AI governance is only a one-time review?
A: A one-time review breaks as soon as the agent gains a new tool, a new dataset, or a new workflow.
Q: Why do AI agents change the IAM risk model?
A: AI agents change the IAM risk model because they can act as authenticated workloads rather than passive tools.
Q: What signals show that an AI governance programme is not working?
A: Warning signs include disconnected models built by different teams, repeated disputes over data ownership, inconsistent approvals and outputs that cannot be explained to stakeholders.
Practitioner guidance
- Implement continuous AI inventory coverage Track browser sessions, desktop apps, developer environments, and agentic plugins so the inventory reflects live use rather than quarterly assumptions.
- Classify intent before enforcing policy Use context-aware controls that assess what the user or agent is trying to do, not just whether a keyword appears in the prompt.
- Tie agent actions back to the initiating identity Record prompts, responses, tool calls, and the human identity behind each activity so agent behaviour can be attributed during audit and incident review.
What's in the full article
WitnessAI's full article covers the operational detail this post intentionally leaves for the source:
- Live examples of how continuous discovery maps AI activity across browsers, desktop apps, developer tools, and agentic plugins
- Runtime policy actions, including allow, warn, block, route, and tokenisation, with practical examples of when each is used
- How audit trails capture prompts, responses, and identity attribution for compliance and incident review
- Production metrics and case references that show how teams measure guardrail precision and approval speed
👉 Read WitnessAI's analysis of AI governance as a continuous improvement loop →
AI governance as a continuous loop: are your controls keeping up?
Explore further
02/09/2026 1:30 pm
AI governance is becoming an identity problem as much as a policy problem. Once AI tools, agents, and model workflows touch data and execute actions on behalf of users, the governance question shifts from approval to delegated control. That means inventory, access, and audit are now core governance functions, not supporting tasks. For identity leaders, the implication is clear: AI oversight must be treated as part of the access-control lifecycle, not as a separate compliance layer.
A question worth separating out:
Q: Should organisations prioritise runtime enforcement before broad cloud coverage?
A: If the highest risk lives in running Kubernetes workloads, yes. Runtime enforcement can block unsafe deployments and surface behaviour that posture tools never see, even if broad multi-cloud coverage is still useful for other teams. The right order depends on where active exploitation is most likely to occur.
👉 Read our full editorial: AI governance as continuous improvement: why annual reviews fail
