Notifications
Clear all
Topic starter
18/08/2026 2:31 pm
TL;DR: Gartner says AI agents cannot be trusted to follow instructions as intended and predicts independent guardian agents will replace much of today’s AI risk stack in over 70% of organisations by 2029, according to Holistic AI. The core issue is not just model accuracy but runtime governance across clouds, repositories, and identity systems.
NHIMG editorial — based on content published by Holistic AI: Gartner recognizes Holistic AI as a representative vendor in its Market Guide for Guardian Agents
Questions worth separating out
Q: How should security teams govern AI agents that use multiple identity layers?
A: Security teams should inventory every identity layer an agent can use, including static credentials, session identities, embedded tool identities, and any delegated relationships between agents.
Q: Why do ephemeral workloads complicate traditional IAM and access review processes?
A: Because the identity may exist for minutes or hours, while access review cycles operate on days or weeks.
Q: What breaks when AI governance relies only on approval workflows?
A: Approval-only governance breaks when usage shifts outside sanctioned channels.
Practitioner guidance
- Inventory AI agent identities and delegated access Create a register of every AI agent, the identities it uses, the tools it can call, and the data repositories it can reach.
- Add runtime policy enforcement for agent transactions Move beyond pre-deployment approval by enforcing policy at the moment an agent acts.
- Align agent governance with IAM and NHI controls Treat agent access as a governed identity problem, not only an AI risk.
What's in the full article
Holistic AI's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact Gartner wording and market guide context behind the guardian-agent category
- The full set of Gartner predictions about AI agent risk through 2028 and 2029
- Holistic AI's platform framing for continuous oversight across the AI lifecycle
- The original source article and linked report for readers who need the full market context
👉 Read Holistic AI's analysis of Gartner's Market Guide for Guardian Agents →
Guardian agents for AI governance: are current controls keeping up?
Explore further
18/08/2026 3:19 pm
Guardian agents represent a governance control layer, not a new model risk label. The article is best understood as evidence that AI security is moving from model assessment to runtime supervision. That shift matters because agent behaviour can create policy violations even when the underlying model is not compromised. Practitioners should treat this as a control architecture problem, not a branding exercise.
A question worth separating out:
Q: Who is accountable when an AI agent makes an unauthorised change?
A: Accountability should be assigned to the governance model that authorised the delegation, the owner of the workflow, and the team that set the policy boundary. In practice, organisations need clear responsibility for agent configuration, monitoring, and incident response because the machine’s speed does not remove human accountability for the delegated identity.
👉 Read our full editorial: Guardian agents and AI runtime control gaps in enterprise governance
