Topic starter
18/08/2026 2:31 pm
TL;DR: Gartner says AI agents cannot be trusted to follow instructions as intended and predicts independent guardian agents will replace much of today’s AI risk stack in over 70% of organisations by 2029, according to Holistic AI. The core issue is not just model accuracy but runtime governance across clouds, repositories, and identity systems.
Editorial analysis by NHI Mgmt Group, based on content published by Holistic AI: “Gartner® Recognizes Holistic AI as a Representative Vendor in its Market Guide for Guardian Agents”.
Key questions
Q: How should security teams govern AI agents that can change behaviour at runtime?
A: Security teams should govern AI agents with runtime monitoring, behavioural baselines, and identity-triggered response, not just static approval workflows.
Q: Why do guardian agents matter for AI governance and IAM teams?
A: Because AI agents can act across repositories, cloud services, and multiple identity systems, so the trust problem is no longer only model quality.
Q: What are the signs that AI agent lifecycle controls are failing?
A: Common signals include undocumented agents, unclear ownership, persistent tokens, broad permissions that exceed task scope, and retired agents that still have live integrations.
Practitioner guidance
- Define agent identity boundaries Create a governed identity record for every AI agent, including ownership, lifecycle status, and the systems it can reach.
- Enforce runtime action controls Place policy enforcement at the point where the agent executes tool calls, data retrieval, or transactions, not only at approval time.
- Limit cross-system delegated access Review whether an agent needs direct permissions in cloud services, repositories, and identity systems, then remove any broad or persistent access paths.
Bottom line: Guardian agents address a governance gap that appears when AI agents can act across tools, clouds, and identity systems without reliable runtime supervision.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:19 pm
Guardian agents represent a shift from model governance to runtime governance. The core weakness in current AI control stacks is that they often assume policy can be enforced before or after execution. In practice, the agent makes decisions inside the session, and that is where control must live. Practitioners should treat this as a control-plane redesign problem, not a documentation exercise.
A few things that frame the scale:
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: What should organisations do if their AI agents operate across several environments?
A: Assign each agent a consistent identity record, narrow its delegated permissions, and ensure one runtime control layer can apply policy across clouds, repositories, and enterprise applications instead of relying on fragmented local checks.
👉 Read our full editorial: Guardian agents and AI runtime control gaps in enterprise governance