Notifications
Clear all
Topic starter
10/07/2026 4:16 pm
TL;DR: Generative AI is shifting enterprise systems from supporting decisions to shaping them, with the source article arguing that trust must be continuously constructed because outputs can look credible without being grounded in certainty. The practical implication is that identity, governance, and audit models must account for systems that participate in the decision chain, not just automate steps.
NHIMG editorial — based on content published by Idemia: Generative AI Is not a wave; it’s a decision shift
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern AI-assisted decision workflows?
A: Treat AI-assisted workflows as governed decision chains, not simple automation.
Q: Why do generative AI systems create new accountability problems?
A: They create accountability problems because they can shape decisions without carrying responsibility for the result.
Q: What do teams get wrong about trusting GenAI outputs?
A: Teams often mistake fluency for reliability.
Practitioner guidance
- Define AI-influenced decision paths Map every workflow where generative AI output can affect approvals, investigations, payments, or access decisions, then assign a human owner for each path.
- Add validation gates before action Require source-data verification, policy checks, or second review before any AI-generated recommendation is used to change a controlled outcome.
- Document accountability for exceptions Record who can override AI output, who must review overrides, and what evidence is retained when the system influences a final decision.
What's in the full article
Idemia's full article covers the operational detail this post intentionally leaves for the source:
- How the author translates generative AI into enterprise decision-making across payments, identity, and cybersecurity.
- The practical governance tensions between speed, accountability, and human validation in regulated workflows.
- Examples of where AI-assisted processes can quietly remove safeguards while still appearing complete.
- The author's perspective on how trust should be designed into systems from the start.
👉 Read Idemia's analysis of why generative AI changes decision-making →
Generative AI and decision responsibility: what changes for IAM teams?
Explore further
10/07/2026 4:18 pm
Generative AI creates a decision responsibility gap before it creates a technical control gap. The article is right to frame GenAI as a shift in how value is produced, because that shift also changes where accountability lives. Once a system starts shaping decisions, the organisation must govern not only the output but the influence pathway from model to action. For practitioners, the key issue is that legacy approval chains were built for recommendations, not for systems that compress recommendation into near-decision state.
A few things that frame the scale:
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
A question worth separating out:
Q: How do organisations keep human oversight meaningful in AI workflows?
A: Human oversight stays meaningful only when humans have enough context, time, and authority to intervene. If the AI output is acted on automatically or too quickly to challenge, oversight becomes ceremonial. Effective oversight requires review points, clear escalation rights, and the ability to halt or reverse the decision.
👉 Read our full editorial: Generative AI changes decision-making, not just automation
