Topic starter
23/10/2026 12:47 am
TL;DR: Insider-risk programmes can no longer assume a human is always the actor behind trusted access, DTEX says. Identity governance now has to trace attribution and intent across actions taken through AI systems and agents.
Editorial analysis by NHI Mgmt Group, based on content published by DTEX: “Insider Threat Awareness Month 2026: The Expanding Definition of Insider Risk”.
Key questions
Q: Why do AI agents complicate insider threat governance?
A: AI agents inherit human permissions and can act repeatedly without waiting for approval on each step, so they inherit both access and speed.
Q: What are the signs that insider threat analytics are failing in an AI-enabled environment?
A: A common sign is that detections for bulk repository access are either generating constant alerts or have been tuned down until they rarely fire.
Q: How should teams manage insider risk when AI agents have legitimate access to sensitive data?
A: Treat AI agents as governed non-human identities, not as ordinary tools.
Practitioner guidance
- Define delegated AI action boundaries Write policy that distinguishes direct human action from agent-executed action on a person’s behalf, including who approves, who owns, and what the allowed purpose is.
- Classify insider-risk events by actor type Update case workflows so investigators can tag activity as human-initiated, agent-executed, or mixed, then route the case to the right reviewer.
- Correlate access with instruction context Pair access telemetry with prompts, workflow triggers, or delegated instructions so analysts can judge whether the action matched intended use.
Bottom line: Insider-risk programmes can no longer assume a human is always the actor behind trusted access.
Glossary terms: Insider Risk Management, Delegated Access, Trusted Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Trusted access is now a shared control problem between people and systems. Insider-risk models that assume a human is always the actor are already incomplete. When an AI agent can execute business actions through a valid account, the governance question becomes whether the access was bounded, observable, and attributable enough to survive delegated use. Practitioners should treat identity as only one part of the insider-risk equation.
A question worth separating out:
Q: Who is accountable when an AI system makes a harmful decision?
A: Accountability should follow the identity chain that authorized, configured, or triggered the action, including the human owner, the platform team, and any delegated agent or tool account. If the organisation cannot name that chain, the governance model is too weak for regulated AI use.
👉 Read our full editorial: Insider risk programs must now account for AI-driven access
This post was modified 6 days ago by NHI Mgmt Group