Topic starter
30/07/2026 11:21 pm
TL;DR: Twenty-three percent of organisations have already experienced AI incidents while 79% have no dedicated AI governance team, and 51% cannot identify all AI agents in their systems, according to Pathlock research. The governance problem is no longer theoretical: AI agents are already executing approvals and workflow actions faster than most control structures can trace or explain.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “Enterprises Are Handing AI Agents Financial Workflows, While More Than Half Can’t Fully Verify Their Actions”.
By the numbers:
- 79% of organisations have no dedicated AI governance team or officer.
- 51% of organisations cannot verify all the AI agents operating in their systems.
Key questions
Q: What breaks when AI agents can approve transactions without dedicated governance?
A: The control breaks at accountability, traceability, and review.
Q: Why do AI agents increase risk in ERP and finance systems?
A: They increase risk because they can touch high-value records, make decisions from context, and operate with access that is often broader than a person would need.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Define AI agent ownership and approval boundaries Assign a named business and technical owner for every agent that can approve, modify, or post records, and require explicit approval scope for each business process.
- Inventory every AI agent with delegated authority Build a live register of agents, tool connections, system access, and business processes so no agent remains untracked across finance, procurement, HR, or database workflows.
- Remove direct write access where workflow controls should apply Block AI agents from bypassing application-level controls into backend databases unless the same approval, validation, and evidence chain is enforced elsewhere.
Bottom line: AI agents are now operating inside core business controls, which means governance failures can affect approvals, records, and workflow integrity rather than just model output.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:24 pm
AI agents have crossed the threshold from automation into governable identity. Once an agent can approve transactions or modify records, the control problem is no longer just access to tools, but delegated authority with business impact. That makes lifecycle ownership, scope control, and revocation central to the governance model. Practitioners should treat agent identity as a first-class control object, not a side effect of application automation.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI as an application or as an identity?
A: Treat it as an identity when the AI can access data, invoke tools, or participate in workflows that affect business systems. That framing makes least privilege, just-in-time access, and lifecycle governance relevant. If you keep treating it only as an application, you will miss the access and delegation behaviours that actually create risk.
👉 Read our full editorial: AI agent governance gaps are widening in enterprise control systems