Topic starter
09/06/2026 11:58 pm
TL;DR: Agentic AI is moving into production faster than governance policies can keep up, with 91% of tech decision makers saying their organisations are already developing or rolling out it and only 48% having the policies to oversee it, according to Collibra/Harris Poll. The core issue is accountability, because agents can act across workflows before ownership, traceability, and intervention are defined.
Editorial analysis by NHI Mgmt Group, based on content published by Collibra: “Collibra Launches AI Command Center to Scale Agentic AI with Real-Time Oversight and Continuous Control”.
By the numbers:
- 91% of tech decision makers say their organisations are already developing or rolling out agentic AI, according to Collibra/Harris Poll survey results cited by Collibra.
Key questions
Q: What breaks when agentic AI is governed only with static policies?
A: Static policies assume the actor, context, and purpose stay stable long enough for review.
Q: Why do AI agents create accountability gaps in existing identity models?
A: Traditional access models were built for people, but AI agents can retrieve data, open tickets, and run code across many systems in seconds.
Q: How do organisations know if agentic AI governance is actually working?
A: Look for three signals: access decisions tied to task context, complete audit records linking agents to datasets, and rapid revocation when scope changes.
Practitioner guidance
- Define runtime ownership for every production agent Assign a named owner for each deployed agent, plus an escalation path for actions that cross business, security, or compliance thresholds.
- Instrument agent decisions with auditable traces Capture what data the agent used, which tools it called, and what outcome it produced so reviewers can reconstruct decisions after an incident or policy breach.
- Move governance checks into the execution layer Require validation signals from the pipeline and runtime path before an agent is allowed to act on sensitive workflows or regulated data.
Bottom line: Agentic AI turns governance into a runtime identity problem because systems are no longer just producing recommendations, they are taking actions across workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
10/06/2026 2:32 am
Agentic AI governance is now an identity problem, not just a model-risk problem. Once software can initiate actions across workflows, the control question shifts to who owns the agent, what it can touch, and how its decisions are traced. Data governance alone cannot close that gap because the behaviour is execution-time, not only design-time. Practitioners need to treat agent identity and lifecycle as part of the governance model.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Another finding in the same research shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How can organisations tell whether agent governance is working?
A: Organisations can tell agent governance is working when they can answer three questions quickly: who owns the agent, what it accessed, and which actions were approved or blocked. If those answers require manual reconstruction after an incident, the governance model is not operational enough for production AI.
👉 Read our full editorial: AI command centers expose the governance gap in agentic AI
11/06/2026 1:32 am
Agentic AI governance is now an identity problem, not just a model-risk problem. Once software can initiate actions across workflows, the control question shifts to who owns the agent, what it can touch, and how its decisions are traced. Data governance alone cannot close that gap because the behaviour is execution-time, not only design-time. Practitioners need to treat agent identity and lifecycle as part of the governance model.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Another finding in the same research shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How can organisations tell whether agent governance is working?
A: Organisations can tell agent governance is working when they can answer three questions quickly: who owns the agent, what it accessed, and which actions were approved or blocked. If those answers require manual reconstruction after an incident, the governance model is not operational enough for production AI.
👉 Read our full editorial: AI command centers expose the governance gap in agentic AI
12/06/2026 3:06 am
Agentic AI governance is now a runtime identity problem, not a policy problem. Once agents take actions across workflows, the governance question shifts from approval to continuous control. Static oversight assumes a stable actor and a stable purpose; agentic systems break both assumptions. The implication is that access, ownership, and traceability must be governed at execution time, not only through predeployment review.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat governed context for agents like an access control issue?
A: Yes, because context can shape what an agent decides just as much as credentials shape what it can reach. The practical boundary is no longer only the token or permission set. Teams should govern the context an agent receives, the systems it can act on, and the traceability of both.
👉 Read our full editorial: AI command centers expose the governance gap in agentic AI
This post was modified 2 days ago by NHI Mgmt Group