What breaks when teams try to govern AI agents through a directory model?

Why directory-first governance fails for AI agents

Directory models assume a stable population: something is enrolled, stays present long enough to be reviewed, and can be certified on a schedule. AI agents do not behave that way. Their runtime existence, delegated authority, and tool access can appear and disappear faster than a directory workflow can finish, so the directory becomes a record system rather than the control point.

That matters because the security decision is not “does this agent exist in the directory?” but “does this runtime actor have the right authority right now?” In practice, the control has to follow the agent’s live permissions, not just its registration state. AI Agent Authorisation Guide is useful here because it treats task-scoped access, just-in-time approval, and per-action policy as the real governance layer.

Directory-first thinking also breaks when teams confuse inventory with protection. A directory can help you discover agents, owners, and intended purpose, but it does not guarantee that an agent is still active, still trusted, or still limited to the permissions it should have. That is why Shadow AI and AI Agent Discovery Guide is a better complement to governance than a directory alone, because discovery and governance are not the same thing.

What is the control-plane mismatch?

The mismatch is between lifecycle speed and administrative workflow. Directories are good at representing entities, ownership, and intended entitlements, but AI agents often act through short-lived sessions, delegated tokens, or temporary tool access. By the time a human review catches up, the actor may have already completed the risky action or vanished before certification closes.

This is why the control plane must observe the live request path. A mature approach verifies the principal, the action, and the context at the moment of execution, then constrains what the agent can do based on that request. Zero Trust for AI Agents aligns with that model because it shifts the trust decision from enrollment status to continuous verification and no standing privilege.

It also explains why agent identity and agent lifecycle matter more than directory completeness. If the agent can obtain access outside the directory’s review window, then the directory has become an audit artifact instead of an enforcement layer. Agentic AI Identity Guide covers the underlying identity, delegation, registration, and retirement issues that directory-only governance tends to miss.

What should teams govern instead of the directory record?

Teams should govern the live permission boundary: who or what the agent is acting for, what it can do, which tools it can reach, and under what approval or policy conditions. That means focusing on delegated authority, per-action authorization, short-lived access, and explicit offboarding when the agent is no longer needed.

Good governance also requires observability. If an agent can act, the organisation should be able to attribute that action, detect when behaviour drifts, and revoke access quickly. AI Agent Observability, Audit and Incident Response Guide is relevant because it ties logging, attribution, and kill-switch design to the actual runtime behaviour of agents.

For broader security framing, the issue is not unique to one product or one identity store. It is a governance pattern: the asset to protect is the action surface, not the directory row. NIST AI Risk Management Framework supports that view by emphasizing governance, measurement, and ongoing risk management around AI systems rather than one-time enrollment checks.

Risk and Threat Considerations

Directory-first governance creates a blind spot when an agent can obtain or use access before it is fully inventoried, certified, or retired. That opens the door to overprivilege, stale access, and unobserved action, especially when agents are provisioned quickly or chained through multiple tools and services.

Failure mechanism: The organisation treats registration as protection, but the real risk occurs at runtime, where the agent can exercise delegated authority, inherit excess permissions, or disappear before a review catches up.

Impact: A short-lived or unmanaged agent can still steal data, trigger destructive actions, or persist through tokens and tool access even after the directory record is removed.

Practitioner Guidance

What to prioritise: Put runtime authorization and revocation ahead of directory completeness. If the agent can reach production tools, the first question is whether access is bounded and observable, not whether the record is clean.

What to verify: Confirm that every agent has an owner, a purpose, an expiry or retirement path, and a policy decision point that can deny or narrow access per action. If those controls do not exist, the directory is not a governance control, only an inventory source.

Common mistake: Teams often try to certify agents the same way they certify human accounts. That fails when the agent’s useful life is shorter than the approval cycle. NIST SP 800-53 Rev 5 Security and Privacy Controls remains relevant as a control catalogue, but only when mapped to live authorization, credential lifecycle, and audit outcomes rather than static record-keeping.

Practitioner takeaway: Govern AI agents at the point of action, because a directory can describe an agent, but it cannot by itself stop an ephemeral actor from doing harm.

Related resources from NHI Mgmt Group

• What breaks when security teams govern AI agents only through policy documents?
• How should security teams govern API keys used for generative AI access?
• How should security teams govern Active Directory service accounts?
• How should security teams govern AI agents that use Model Context Protocol?