Why do AI agent governance programs stall even when teams have good visibility and documentation?

Why This Matters for Security Teams

AI agent governance stalls when teams mistake inventory for control. Good documentation can show which agents exist, who owns them, and what they are supposed to access, but autonomous systems do not wait for a weekly review cycle. They can chain tools, change tactics, and create new risk faster than manual approvals can keep up. That is why visibility programs often look mature on paper while exposure keeps growing.

This gap is now visible in industry research. NHIMG’s AI Agents: The New Attack Surface report found that 80% of organisations say their AI agents have already acted beyond intended scope, yet only 52% can track and audit the data those agents access. Current guidance from the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10 both point toward runtime governance, not just static documentation.

In practice, many security teams encounter agent misuse only after data has moved, credentials have been exposed, or an external tool has already been chained in a way nobody approved.

How It Works in Practice

Effective governance for AI agents has to treat enforcement as a live workflow, not an after-action review. The operating model should start with workload identity for the agent itself, then layer on runtime policy checks, short-lived secrets, and explicit revocation when the task ends. That approach aligns with the direction of the CSA MAESTRO agentic AI threat modelling framework and the NIST Cybersecurity Framework 2.0, both of which emphasise repeatable control execution.

In practice, teams need control points that fire at request time:

• Issue a workload identity so the agent proves what it is before it gets access.
• Use just-in-time, task-scoped credentials instead of standing secrets with long TTLs.
• Evaluate policy at runtime with context, such as purpose, target system, data sensitivity, and step-up requirements.
• Auto-revoke tokens and sessions when the task completes or the context changes.
• Log every tool call and data access so review becomes detective work, not guesswork.

This is where documentation helps but is not enough on its own. A control map may show that a sales agent should not reach finance systems, but only runtime policy can stop a malformed prompt, an unexpected tool chain, or a delegated sub-agent from crossing that boundary. NHIMG’s OWASP Agentic Applications Top 10 highlights why pre-approved paths still fail when agent behaviour is dynamic. These controls tend to break down when the environment mixes legacy long-lived service accounts, broad API permissions, and high-frequency agent actions because review and revocation cannot keep pace with execution.

Common Variations and Edge Cases

Tighter runtime control often increases operational overhead, requiring organisations to balance safety against latency, integration effort, and developer friction. That tradeoff becomes sharper in multi-agent systems, where one agent can delegate to another and multiply the number of policy decisions that have to happen in real time. There is no universal standard for this yet, but current guidance suggests that the more autonomous the system, the more enforcement must move from periodic governance to event-driven control.

Some environments need extra nuance. Human-in-the-loop approval can still make sense for irreversible actions, but it should not be the primary gate for ordinary access checks. Likewise, static RBAC is useful for coarse scoping, yet it cannot express intent well enough when the agent’s next step depends on live context. That is why many practitioners are moving toward policy-as-code patterns and zero standing privilege, then using exceptions only where the business process truly requires them. NHIMG’s Moltbook AI agent keys breach and CoPhish OAuth Token Theft via Copilot Studio show how quickly standing access becomes the failure point when secrets live too long.

The practical lesson is simple: if an agent can act at machine speed, governance must also execute at machine speed.

Related resources from NHI Mgmt Group

• Why is single-provider AI agent governance not enough for enterprise security?
• Why is visibility important in AI governance?
• What makes agentic AI an NHI governance issue?
• Why is NHI governance critical in the age of AI attacks?