Topic starter
01/08/2026 10:51 pm
TL;DR: AI security splits into three control planes, with Anomali arguing they need different owners and controls. Governance now has to track agent permissions, auditability and scope so automation does not turn into unmanaged autonomy.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Securing the Three Pillars of AI: A Practical Framework for Security Leaders”.
Key questions
Q: Why do agent permissions create a different risk model from traditional application access?
A: Agent permissions can combine data access, tool execution and decision influence inside one runtime workflow.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Q: What breaks when AI security teams treat threats, models and operations as one problem?
A: Controls drift because the same programme tries to manage adversarial AI use, model governance and AI-assisted operations with one set of owners and metrics.
Practitioner guidance
- Separate AI security ownership by control plane Assign distinct owners for AI-powered threat defence, AI system security and AI-enabled operations so the controls, evidence and success measures do not blur together.
- Inventory agents, integrations and decision paths Document every model, agent, pipeline, partner integration and third-party dependency that can affect AI behaviour or access scope.
- Treat agent permissions as governed identity Review what each agent can read, call and change, and bind those permissions to explicit approval, logging and revocation processes.
Bottom line: AI security splits into separate threat, model and operations problems, and each plane needs different controls and owners.
Glossary terms: Agentic AI, AI Governance, Agent Permissions, Auditability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 hours ago by NHI Mgmt Group
01/08/2026 10:59 pm
AI security is now three governance problems, not one. Security leaders who bundle threats, models and AI-assisted operations into a single programme obscure ownership and end up with mismatched controls. The article’s framework is useful because it forces different metrics for different risk planes. Practitioners should align threat detection, model governance and operational automation as separate workstreams with explicit handoffs.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: When should organisations expand agentic AI beyond pilot use cases?
A: Only after the use case is bounded, the permissions are explicit and the audit layer can explain what happened in production. Expansion without those conditions turns experimentation into hidden operational risk. The practical test is whether the organisation can govern the agent as a controlled runtime actor, not just demonstrate a useful outcome.
👉 Read our full editorial: Securing AI requires separate controls for threats, models and operations