Topic starter
02/08/2026 11:39 am
TL;DR: AI governance still leaves agent permissions, workflow visibility and runtime guardrails under-controlled, Akto reports, even where policy and accountability are in place. Agent identity needs runtime scope, observability and revocation controls if governance is to cover what agents can actually do.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “AI Governance Framework: Building Responsible AI Systems”.
Key questions
Q: Why do agent permissions create more risk than model outputs alone?
A: Agent permissions expand risk because the harm comes from what the system can do, not only what it can say.
Q: What signs show that an AI agent is not yet governable?
A: Warning signs include unexplained completions, repeated mistakes after feedback, outputs that cannot be traced to evidence and workflows where operators cannot see intermediate actions.
Q: What do security teams get wrong about AI agent identity governance?
A: They often assume human IAM patterns can be reused with minor adjustments.
Practitioner guidance
- Define agent identities separately from user identities Create distinct identity records, ownership, and lifecycle rules for AI agents, including who approves access, who can revoke it, and which systems each agent may touch.
- Scope tool access to task-specific boundaries Limit each agent to the minimum tools, APIs, and data sources needed for a single workflow, and require explicit approval for anything outside that task boundary.
- Instrument workflow-level observability Capture agent identity, tool calls, decision paths, and delegated actions in logs so teams can reconstruct how an outcome was produced end to end.
Bottom line: AI governance frameworks still leave a practical gap when agents can hold identity, call tools and move through workflows under delegated authority.
Glossary terms: Agent Identity, Runtime Guardrail, Workflow observability, Delegated Authority Model
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:51 pm
Agent identity is now a governance object, not just an implementation detail. Traditional AI governance frameworks were built around oversight of models, data and human decisions. Agentic systems change the question because the system itself can hold and exercise authority through tools, workflows and delegated access. That means identity, authorisation and lifecycle control must sit inside governance, not beside it. The practitioner conclusion is straightforward: if the agent can act, the agent must be governed as an identity-bearing runtime actor.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: Should teams treat agentic AI access as a PAM or IAM design problem?
A: Both, but the design problem is more specific than traditional PAM. Agentic systems need runtime authorisation at the tool-call boundary, while IAM must define who or what is allowed to initiate those calls. If the decision stays at session setup, the control arrives too early and too broadly.
👉 Read our full editorial: AI governance frameworks still leave agent identities under-governed