Notifications
Clear all
Topic starter
16/08/2026 4:59 pm
TL;DR: Most organisations are trying to govern AI with partial visibility into copilots, agent SDKs, local runtimes, MCP servers, and shadow-AI signals, according to Visiq Labs, which argues that discovery must establish an evidence-based inventory before runtime controls or audit evidence can be trusted. The core issue is not policy design but control coverage: without knowing what exists and where it sits, governance remains aspirational.
NHIMG editorial — based on content published by Visiq Labs: Discover Before You Govern
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, making organisations failing to scope AI access properly 4.5x more likely to experience a security incident.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: What breaks when AI governance starts with policy instead of inventory?
A: Policy-first programmes usually stall because teams cannot define scope, boundaries, or ownership with confidence.
Q: Why do AI agents create a governance problem for IAM teams?
A: AI agents create a governance problem because they authenticate and act as autonomous software entities with tool access.
Q: How do you know if AI discovery is actually working?
A: AI discovery is working when the organisation can produce one authoritative inventory, classify tools consistently, and explain which data and permissions each tool can reach.
Practitioner guidance
- Establish a project-level AI inventory baseline Map agent frameworks, MCP servers, local runtimes, coding agents, and provider-key sprawl by project so governance coverage is visible at the workflow level.
- Classify every surface as governed, observed, or not visible Use explicit coverage states to prevent clean scans from being mistaken for full control and to drive follow-up on blind spots.
- Treat provider keys and tool credentials as lifecycle assets Track where keys appear in env files, shells, extensions, and repos, then connect discovery to rotation and revocation workflows.
What's in the full article
Visiq Labs' full whitepaper covers the operational detail this post intentionally leaves for the source:
- How the discovery sensor identifies frameworks, MCP configurations, local model runtimes, and shadow-AI signals across hosts and projects
- How coverage states are assigned so teams can distinguish governed, observed, and not-visible surfaces
- How the rollout sequence moves from discovery to prioritisation and then to runtime governance without starting a separate project
- How read-only scanning and secret fingerprinting are handled to avoid collecting plaintext credentials
👉 Read Visiq Labs' whitepaper on discovering AI before you govern it →
AI governance inventory gaps: what practitioners need to fix first?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
16/08/2026 5:00 pm
Inventory is now a governance control, not an administrative task. AI governance programmes fail when discovery is treated as a preamble instead of the control layer that determines what can be governed at all. In agentic environments, the inventory is part of the control plane because it establishes scope, ownership, and coverage status. Practitioners should treat incomplete discovery as an active governance deficiency, not a documentation issue.
A question worth separating out:
Q: Who is accountable when an AI agent acts outside its intended scope?
A: The organisation is accountable, but operational responsibility should sit with a named owner and a governance process that can explain the agent’s purpose, access, and recorded actions. Without that, autonomous behaviour becomes unassignable risk rather than managed automation.
👉 Read our full editorial: AI governance starts with inventory, not policy
