Notifications
Clear all
Topic starter
30/07/2026 11:21 pm
TL;DR: Twenty-three percent of organisations have already experienced AI incidents while 79% have no dedicated AI governance team, and 51% cannot identify all AI agents in their systems, according to Pathlock research. The governance problem is no longer theoretical: AI agents are already executing approvals and workflow actions faster than most control structures can trace or explain.
NHIMG editorial — based on content published by Pathlock: the AI Governance Gap Report findings on AI agents and enterprise governance
By the numbers:
- 79% of organizations have no dedicated AI governance team or officer.
- 51% aren’t confident they know all the AI agents operating in their systems.
- 52% cannot verify actions AI agents execute across business systems.
Questions worth separating out
Q: What breaks when an AI agent can act across multiple business systems?
A: Traditional helpdesk controls break because they assume a human can be held at the centre of the workflow.
Q: Why do AI agents need separate governance from ordinary automation?
A: AI agents need separate governance because they can make context-sensitive decisions and execute actions across multiple systems with delegated access.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Build a complete AI agent inventory Catalog every AI agent, its owner, its data sources, its tool chain, and the business actions it can perform.
- Restrict agent authority to task-scoped privileges Remove broad permissions from agents that create records, approve transactions, or access backend databases.
- Correlate identity and transaction logs Join IAM, application, and workflow telemetry so investigators can reconstruct what the agent did, which systems it touched, and what input influenced the action.
What's in the full report
Pathlock's full research covers the operational detail this post intentionally leaves for the source:
- Survey methodology and respondent mix across IT, compliance, and security decision-makers.
- The five governance priorities Pathlock identifies for AI agent deployment.
- The full breakdown of where organisations allow AI agents to create records, approve transactions, and access databases.
- The report download includes the evidence base behind the investigation and accountability findings.
👉 Read Pathlock's full AI Governance Gap Report on AI agents and enterprise control risk →
AI agent governance gaps: what IAM and GRC teams must address?
Explore further
30/07/2026 11:24 pm
AI agents are becoming governed identities, not just automation tools. Once an agent can approve, modify, and execute business actions, the right control question is no longer whether the workflow is automated. It is who owns the identity, what authority it has, and how its actions are evidenced. This is where IAM and GRC converge. Practitioners should treat agent identity as a first-class governance domain rather than an extension of scripting or RPA.
A question worth separating out:
Q: Who is accountable when an AI agent triggers a banking error or compliance breach?
A: Accountability sits with the institution that granted the agent access, defined its scope, and failed to govern its actions. Banking regulators will focus on whether the bank can prove effective oversight, traceability, and control over both human prompts and autonomous actions.
👉 Read our full editorial: AI agent governance gaps are widening in enterprise control systems
