Topic starter
02/08/2026 11:32 am
TL;DR: AI TRiSM is shifting from documentation and policy-setting into runtime inspection, cataloging, and enforcement for AI models, applications, and agents, according to Akto’s analysis of Gartner guidance. That change matters because static governance cannot reliably control agentic systems that act in real time across data, tools, and approvals.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “AI TRiSM Explained: Building Secure and Trusted AI Systems”.
Key questions
Q: Where does AI governance fail when agentic systems act in real time?
A: It fails when governance stops at policy, documentation, and approval.
Q: When should organisations move from policy design to runtime enforcement for AI systems?
A: As soon as agents begin touching production data, customer workflows, or regulated information.
Q: What signs show that AI cataloguing is incomplete or failing?
A: Common signs include unknown AI integrations, inconsistent ownership, missing data lineage, and controls that differ by team or environment.
Practitioner guidance
- Build an authoritative AI inventory Track every model, agent, application, and embedded AI integration, including third-party and retrieval-augmented systems, so you know what must be governed.
- Map AI data dependencies and permission paths Document what data each AI system trains on, retrieves, or can reach during execution, then align those paths to existing access and retention rules.
- Move policy checks into live AI transactions Inspect inputs, outputs, and tool calls at runtime, with block, auto-remediate, or escalate actions for policy violations and anomalous behaviour.
Bottom line: AI TRiSM is moving from policy-centric oversight to live enforcement, which is a necessary response to agentic systems that can act before humans intervene.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:47 pm
AI TRiSM is becoming a runtime control plane, not a governance memo. The article is right to separate documentation from enforcement, because modern AI systems can complete decisions and actions before a human review cycle ever starts. For identity teams, that shifts AI governance from paper assurance to live control at the moment of access, tool use, or data disclosure. The practitioner conclusion is simple: if a control cannot act during execution, it cannot govern agentic behaviour.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
A: Security teams should introduce agentic AI in phases, starting with bounded use cases such as alert triage before expanding into response and threat hunting. The key is to connect the agent to high-quality evidence, identity data, and threat intelligence, then keep human analysts in the loop for complex judgments. Without that foundation, the agent can act on incomplete context and produce false confidence.
👉 Read our full editorial: AI TRiSM is moving from policy to runtime enforcement