Topic starter
22/06/2026 10:22 am
TL;DR: AI agents are already embedded across enterprise workflows, yet most security teams still lack visibility into decision chains, policy violations, and overprivileged access, according to Zenity and Gartner. Legacy controls built for static applications are not enough once agents can act, choose tools, and move across environments without human pacing.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Zenity Named in Two Categories in the 2026 Gartner® Hype Cycle™ for Agentic AI”.
By the numbers:
- 17% of organizations have deployed AI agents so far, according to Zenity.
- 42% expect to deploy AI agents in the next 12 months, according to Zenity.
- 22% expect to deploy AI agents within the following year, according to Zenity.
Key questions
Q: Why do static IAM controls break down for AI agent execution?
A: Static IAM assumes privileges can be defined and reviewed in advance, but AI agents make decisions at runtime and can change their execution path during the session.
Q: Why do AI agents increase the risk of over-privileged API access?
A: AI agents often need to move across systems quickly and may reuse the same identity for multiple actions.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Map AI agents as runtime identities Inventory agents by the data, tools, and environments they can reach at execution time, then classify them as governed identities rather than generic automation.
- Move policy enforcement into execution paths Apply controls while the agent is acting, so violations and unsafe tool use are blocked before the task completes.
- Reduce cross-environment privilege combinations Identify when a single agent can combine permissions across SaaS, cloud, and endpoint contexts, then narrow the reachable action set to the minimum needed for the workflow.
Bottom line: AI agents turn governance into a runtime problem because decision chains, tool use, and action timing all happen faster than static controls can observe.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:15 am
AI agent governance is becoming a runtime control problem, not an access review problem. The article’s core insight is that autonomous or semiautonomous agents can move through decision chains faster than review cycles can observe them. That breaks the assumption that governance can happen after access is granted. Practitioners should treat runtime enforcement as the governance boundary, not the audit trail.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Deployment-time control sets the initial configuration, but it does not account for changing context, task scope, or live risk. Request-time control evaluates identity, intent, and policy when the agent actually seeks access. For MCP-connected agents, that distinction matters because the safest decision is often made at the moment of use, not when the system is first installed.
👉 Read our full editorial: AI agent governance needs a new control plane for runtime risk