Notifications
Clear all
Topic starter
18/08/2026 2:42 pm
TL;DR: Human-in-the-loop governance breaks down when agentic AI plans, invokes tools, and adapts at machine speed, according to Holistic AI. The practical shift is toward continuous control, execution-time policy enforcement, and monitoring of drift, tool misuse, and cross-agent feedback loops rather than ceremonial approvals.
NHIMG editorial — based on content published by Holistic AI: From Human-in-the-Loop to AI-governing-AI: Evolving Oversight for Agentic Systems
Questions worth separating out
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review.
Q: Why do agentic AI systems increase initial access and privilege abuse risk?
A: Because they can chain valid access into multiple tool calls without needing a human to approve each step.
Q: What breaks when AI governance is only a one-time review?
A: A one-time review breaks as soon as the agent gains a new tool, a new dataset, or a new workflow.
Practitioner guidance
- Define runtime control points for agents Identify where agent decisions can be intercepted, constrained, or terminated across prompts, tool calls, memory, and state transitions.
- Scope agent privileges as non-human identities Assign task-scoped access, short-lived credentials, and explicit delegation boundaries to every agent that can touch data or infrastructure.
- Instrument continuous governance telemetry Log model outputs, tool selections, policy decisions, and escalation events in a way that supports real-time detection of drift and misuse.
What's in the full article
Holistic AI's full blog covers the operational detail this post intentionally leaves for the source:
- The platform view of continuous visibility across model outputs, tools, memory, and state for runtime governance.
- How policy enforcement is handled during execution rather than after the fact.
- The lifecycle oversight approach for agents interacting with tools, data, and people.
- The operational framing for moving from human-in-the-loop to AI-governing-AI.
👉 Read Holistic AI's analysis of why human-in-the-loop governance no longer scales for agentic AI →
AI governing AI for agentic systems: what changes for practitioners?
Explore further
18/08/2026 3:26 pm
Human-in-the-loop is now an assurance theatre problem: once an agent can plan, call tools, and chain decisions, the human is reviewing an abstraction instead of the action itself. That creates a control gap where the approval exists on paper but not at runtime. In governance terms, the review step becomes too late, too coarse, and too detached from actual risk. Practitioners should treat this as a signal to redesign oversight around execution-time controls, not manual sign-off.
A question worth separating out:
Q: When should organisations treat an AI system as a non-human identity?
A: Treat an AI system as an NHI when it can authenticate, request tools, or perform actions without direct human supervision. At that point it needs inventory, lifecycle, least privilege, monitoring, and revocation controls just like other machine identities.
👉 Read our full editorial: AI governing AI replaces human-in-the-loop oversight for agents
