They focus on acceptable use and content control while ignoring execution authority. That model may work for casual generative AI use, but it does not govern systems that can enrich alerts, trigger containment, or move data between tools. Governance has to follow the action path, not just the prompt.
Why This Matters for Security Teams
ChatGPT-style governance often gets reduced to moderation, prompt filtering, and user policy banners. That misses the real risk: once an AI system can call tools, query data, or trigger workflows, it becomes an execution actor, not just a content generator. The governance problem shifts from “what did it say?” to “what was it allowed to do, with which credentials, and under whose approval?” Current guidance from the NIST AI Risk Management Framework and NHIMG research on Top 10 NHI Issues both point to the same operational truth: identity, privilege, and auditability matter more than content tone.
Security teams also get tripped up by treating all AI use as the same. A chat interface used for drafting emails has very different risk from an agent that can enrich alerts, update tickets, or move records across SaaS systems. The latter requires governance that follows the action path, not only the prompt path. In practice, many security teams encounter cross-system misuse only after a tool-enabled workflow has already been exercised outside the intended control boundary.
How It Works in Practice
Effective governance starts by mapping the AI system’s execution authority. Security leaders should inventory which tools, APIs, connectors, and data stores the model can reach, then classify each action by business impact and sensitivity. That inventory should sit alongside NHIMG lifecycle guidance for NHIs so credentials, approvals, and revocation are handled as part of the identity lifecycle, not as an afterthought. A model that can open a ticket may only need read/write access to one system; a model that can quarantine an endpoint needs stronger approval, tighter logging, and explicit break-glass handling.
From there, governance should move from static policy to runtime controls:
- Use least privilege for every connector and API key, with separate identities for separate workloads.
- Issue short-lived secrets or JIT credentials for high-risk actions, then revoke them automatically when the task ends.
- Require policy checks at request time, not only at deployment time, so context determines whether the action proceeds.
- Log the full chain of action, including tool calls, data movement, and downstream effects, not just the prompt and response.
- Separate content safety from execution safety so a harmless-looking output cannot hide an unsafe action.
Where possible, align the agent to workload identity patterns such as SPIFFE or OIDC-backed service identities, because cryptographic proof of what the workload is matters more than a long-lived shared secret. The NIST AI 600-1 GenAI Profile reinforces that generative systems need operational controls that extend beyond content handling. These controls tend to break down when the AI is wired into many SaaS tools through opaque vendor connectors because the action chain becomes difficult to enumerate and monitor consistently.
Common Variations and Edge Cases
Tighter execution control often increases integration overhead, so organisations have to balance speed against containment. Current guidance suggests there is no universal standard for this yet, especially for mixed environments where a chatbot, a retrieval layer, and an automation engine all share similar model outputs but very different authority levels.
One common edge case is shadow AI: teams adopt a public chat interface first, then later connect it to internal tools without revisiting the governance model. Another is delegated autonomy, where a human approves the task but the system still performs several sub-actions on its own. In both cases, the control boundary shifts from content moderation to identity governance, and NIST Cybersecurity Framework 2.0 and NHIMG’s regulatory and audit perspectives are more useful than generic acceptable-use language.
Another exception is low-risk content-only usage, where prompt policies and moderation can still be appropriate. But once the system can act, the safer assumption is that every tool call is a privilege decision. In practice, organisations usually discover the gap only after a connected workflow has already modified data, escalated a ticket, or triggered an operational change outside the original policy scope.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A01 | Agent tool use and execution authority are the core governance gap here. |
| CSA MAESTRO | GOV-01 | MAESTRO addresses governance for agentic workflows and runtime controls. |
| NIST AI RMF | AI RMF focuses on managing AI risks across governance, mapping, and monitoring. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Static secrets and weak lifecycle controls often underpin unsafe AI integrations. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access control is directly relevant to AI tool permissions. |
Apply AI RMF governance to assign ownership, document risk, and continuously monitor agent actions.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
