Topic starter
11/08/2026 3:25 pm
TL;DR: A commitment to safe, transparent, ethical, and privacy-conscious AI across the AI lifecycle has been made through the CSA AI Trustworthy Pledge, according to Redblock. The pledge is a governance signal, but practitioners still need measurable controls for model risk, accountability, and privacy enforcement.
Editorial analysis by NHI Mgmt Group, based on content published by Redblock: “The AI Trustworthy Pledge: What It Is and Why We Signed It”.
Key questions
Q: How should teams evaluate AI trust pledges in governance reviews?
A: Use the pledge as a governance signal, then ask for evidence.
Q: Why do agentic AI systems complicate identity governance more than traditional service accounts?
A: Traditional service accounts usually follow fixed workflows, while agentic systems can choose actions and sequence them at runtime.
Q: What breaks when AI trust is treated as a policy statement only?
A: Controls become unverifiable.
Practitioner guidance
- Validate pledge claims against control evidence Ask for the logs, approvals, policy checks, and audit artefacts that show how AI decisions are governed in practice, especially where the system affects identity workflows.
- Inventory agentic AI touchpoints in identity workflows Identify where AI systems can request access, trigger remediation, or influence governance decisions, then assign a named owner to each decision path.
- Bound the permissions of AI systems Restrict AI agents to the minimum actions they need, and separate read, recommendation, and execution capabilities so one trust claim does not hide multiple privilege levels.
Bottom line: AI trust pledges can signal intent, but they do not prove that governance controls are functioning across the AI lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 14 hours ago by NHI Mgmt Group
11/08/2026 3:34 pm
AI trust pledges are governance signals, not proof. A public commitment can be useful as a board-level marker, but it does not demonstrate operational control. The difference between aspiration and assurance is measured in approvals, logs, policy enforcement, and audit evidence. Practitioners should treat pledges as a starting point for governance review, not as a control attestation.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations make privacy claims for AI auditable?
A: They tie privacy requirements to measurable controls: data minimisation, retention limits, access boundaries, and records showing who can see or change AI outputs. If AI systems process identity-related data, those controls should be tested the same way access controls and logging are tested in the rest of the programme.
👉 Read our full editorial: AI trust pledges are becoming governance signals, not proof
This post was modified 14 hours ago by NHI Mgmt Group