Topic starter
02/08/2026 9:44 am
TL;DR: AI-native application protection aims to govern the full agentic lifecycle as organisations shift from manual development to agent-driven workflows, according to OXSecurity. The central issue is that existing security models still assume human review, slower change, and visible tool deployment, while agentic systems now create and act inside the gap.
Editorial analysis by NHI Mgmt Group, based on content published by OXSecurity: “In the Mythos Age, 90% of Your Security Budget Protects the Wrong Layer”.
Key questions
Q: How should security teams govern AI-enabled workflows that can act on their own?
A: Treat them as identity-governed execution paths, not just software features.
Q: Why do manual security models fail for AI-native application protection?
A: They assume there is enough time for a human to review change before production impact occurs.
Q: What breaks when AI prompts can trigger production actions directly?
A: The separation between intent and execution breaks first.
Practitioner guidance
- Define runtime authority boundaries for AI workflows Map every prompt-to-action path to explicit permissions, tool scopes, and revocation conditions so agent behaviour cannot exceed its intended authority.
- Move review controls closer to execution time Replace reliance on delayed manual approval with policy checks that evaluate AI actions at the moment they request tool use or production change.
- Inventory AI-enabled workflows as governed assets Track which teams, applications, and automation layers can initiate agentic actions so shadow AI and unreviewed workflows do not escape governance.
Bottom line: Manual security models struggle because AI systems now make and execute decisions inside production workflows faster than review cycles can keep up.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:37 pm
The real control failure is not AI capability, but authority without runtime governance. Once an agent can act inside production workflows, the question is no longer whether the model is intelligent enough. The question is whether its delegated authority is bounded, logged, and revocable at the moment of action. For identity and access teams, that makes agent authorisation a control-plane issue, not a feature checkbox.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What does agentic AI governance require beyond ordinary application security?
A: It requires a control model that covers delegation, tool use, and revocation, not only code and configuration. Application security can protect the software path, but agentic governance must also constrain what the AI is allowed to decide and execute. That is an identity and authorisation problem as much as an appsec one.
👉 Read our full editorial: AI-native application protection exposes gaps in manual security models