What breaks when AI governance relies only on fixed rules?

Why Fixed Rules Fail When AI Behaviour Is Contextual

Fixed rules assume a stable relationship between identity, action, and risk. That assumption breaks the moment the same model is used by different people, in different workflows, against different datasets. A prompt that is harmless in one context can become a disclosure path in another, especially when summaries, tool calls, or follow-on questions expose information indirectly. NIST’s NIST AI Risk Management Framework treats this as a governance problem, not just a filtering problem, because the risk lives in the interaction between system, user, and data.

For NHI and agentic AI programs, the failure mode is usually overconfidence in RBAC or a static policy allowlist. Those controls can define who may act, but they do not reliably capture what the system is trying to do at runtime, whether it is chaining tools, or whether a low-risk request has become a high-risk one because the context shifted. That is why NHIMG guidance in the Top 10 NHI Issues emphasizes lifecycle visibility and scope control, not just initial access issuance. In practice, many security teams encounter this only after a model has already revealed data through a seemingly benign workflow, rather than through intentional exfiltration.

How Context-Aware Governance Replaces Static Allow/Deny Logic

Better governance starts with deciding access at request time, not once at provisioning time. Current guidance suggests combining intent-based authorisation with real-time policy evaluation so the system can assess the task, the caller, the data classification, and the destination before action is taken. For agents, this usually means short-lived permissions, not standing access. JIT credential provisioning, ephemeral secrets, and workload identity help ensure the agent proves what it is and receives only the minimum authority needed for that specific task.

That approach is much closer to how the NIST Cybersecurity Framework 2.0 and the NIST AI 600-1 Generative AI Profile think about operational control: identify the asset, constrain the exposure, and verify behavior continuously. In agentic environments, the control point is often the tool request, not the chat message. That is why policy-as-code engines such as OPA or Cedar, together with SPIFFE or OIDC-backed workload identity, are becoming the practical pattern for non-human identities.

• Use workload identity to authenticate the agent, not a long-lived shared secret.
• Issue JIT credentials per task and revoke them immediately after completion.
• Evaluate policy with full runtime context, including data sensitivity and tool target.
• Log the intent, the decision, and the downstream action for auditability.

NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the Ultimate Guide to NHIs — Regulatory and Audit Perspectives both point to the same operational reality: access decisions must be tied to identity lifecycle and reviewable evidence, not static assumptions. These controls tend to break down in multi-tool agent pipelines where a benign first action becomes a later privilege escalation because the policy engine cannot see the full chain of intent.

Where the Edge Cases Expose the Weakness of Fixed Rules

Tighter context-aware controls often increase latency and policy-maintenance overhead, so organisations have to balance stronger containment against operational speed. That tradeoff becomes visible in environments with many agents, many tools, or fast-changing prompts, where overly rigid rules block legitimate work while overly broad ones permit leakage. Best practice is evolving, and there is no universal standard for this yet, but the direction is clear: governance must be adaptive rather than purely pre-defined.

The biggest edge cases are conversational summarisation, cross-user reuse of the same model endpoint, and autonomous actions that continue after the original request has ended. This is where the DeepSeek breach matters as a cautionary example, because secret exposure and downstream disclosure often arise from weak control boundaries, not just obvious misuse. The right lens is not “Can this prompt be blocked?” but “Can this identity, this task, and this data path be safely authorised right now?” That is consistent with emerging agent governance thinking in NIST AI Risk Management Framework and with agent-focused guidance such as NIST AI 600-1 GenAI Profile. Fixed rules still help as guardrails, but they cannot carry the full burden of risk decisions when the environment is autonomous, goal-driven, and context-sensitive.

Related resources from NHI Mgmt Group

• What breaks when AI governance only covers browser activity?
• What makes agentic AI an NHI governance issue?
• Why is NHI governance critical in the age of AI attacks?
• Why is single-provider AI agent governance not enough for enterprise security?