Topic starter
02/08/2026 11:39 am
TL;DR: AI governance frameworks are increasingly defined by policy, monitoring, and accountability controls, but enterprise practice still leaves a gap around agent permissions, workflow visibility, and runtime guardrails, according to Akto and broader governance guidance. The real issue is not whether governance exists, but whether it governs dynamic AI behaviour before it becomes operational risk.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “AI Governance Framework: Building Responsible AI Systems”.
Key questions
Q: What do security teams get wrong about AI agent identity governance?
A: They often assume human IAM patterns can be reused with minor adjustments.
Q: Why do agent permissions create more risk than model outputs alone?
A: Agent permissions expand risk because the harm comes from what the system can do, not only what it can say.
Q: What signs show that an AI agent is not yet governable?
A: Warning signs include unexplained completions, repeated mistakes after feedback, outputs that cannot be traced to evidence and workflows where operators cannot see intermediate actions.
Practitioner guidance
- Define agent identities separately from user identities Create distinct identity records, ownership, and lifecycle rules for AI agents, including who approves access, who can revoke it, and which systems each agent may touch.
- Scope tool access to task-specific boundaries Limit each agent to the minimum tools, APIs, and data sources needed for a single workflow, and require explicit approval for anything outside that task boundary.
- Instrument workflow-level observability Capture agent identity, tool calls, decision paths, and delegated actions in logs so teams can reconstruct how an outcome was produced end to end.
Bottom line: AI governance frameworks still leave a practical gap when agents can hold identity, call tools and move through workflows under delegated authority.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:51 pm
Agent identity is now a governance object, not just an implementation detail. Traditional AI governance frameworks were built around oversight of models, data and human decisions. Agentic systems change the question because the system itself can hold and exercise authority through tools, workflows and delegated access. That means identity, authorisation and lifecycle control must sit inside governance, not beside it. The practitioner conclusion is straightforward: if the agent can act, the agent must be governed as an identity-bearing runtime actor.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: Should teams treat agentic AI access as a PAM or IAM design problem?
A: Both, but the design problem is more specific than traditional PAM. Agentic systems need runtime authorisation at the tool-call boundary, while IAM must define who or what is allowed to initiate those calls. If the decision stays at session setup, the control arrives too early and too broadly.
👉 Read our full editorial: AI governance frameworks still leave agent identities under-governed