Govern the Action, Not the Actor

01 The problem, stated once

Adoption intent for AI agents is the most aggressive of any recent enterprise technology, yet production use is thin: 79% of enterprises report adopting AI agents while only 11% run them in production1, and much of the remainder is "agentwashing" — older automation rebranded1. The distance between those two numbers is the control problem.

02 Why this is not "IAM for robots"

The instinct is to reuse existing identity tooling. It does not transfer, for two structural reasons.

Speed and scale

A human requests access, a manager approves, a quarterly review checks it. An agent can act across hundreds of systems in seconds2single source, so a review cadence measured in months cannot see what it does. Machine identities already outnumber humans by a wide margin, commonly cited near 80-to-13single source.

Identity is not control

This is the conceptual core. Issuing an agent a verifiable identity is only the entry step; it states who the actor is, not what the action may be. Credentials that let an agent in become standing privilege once they are over-scoped or left active4. Worse, a clean-looking credential can understate real reach, because agents acquire privileges at runtime through tool use, OAuth flows and role assumption — so standing privilege understates effective access at any given moment5. The control plane that matters is therefore identity, privilege and runtime enforcement, not policy prose6.

The single metric that captures the risk is blast radius: one agent session can chain actions across systems faster than human review can observe, which makes privilege excess — not model hallucination — the dominant failure mode for enterprise deployment6.

03 The one idea everything reduces to

Control of an agent's actions must happen at runtime, in the execution path, and outside the agent's own process. Three conditions:

1. In-path and blocking, not observing. Genuine control is synchronous — the agent must receive an allow-or-block decision before it proceeds, and the target API is never called if the action is blocked7. Logging after the fact is reactive and cannot prevent harmful operations from executing8.
2. Outside the model's reasoning. The enforcement point must not trust the prompt. An agent's effective permissions should be the intersection of the user's rights and the agent's allowed capabilities — never the union — which prevents confused-deputy failures where an injected prompt drives misuse of broad access9.
3. Outside the agent's process boundary. If the engine runs inside the agent, then a spawned child process, an out-of-band connection, or an injected reasoning loop can bypass interception while the engine reports that enforcement held when it did not10. The remedy is independent observation: verifying what happened against what the engine believes happened.

04 The hard limit — prompt injection may not be fixable

Every control above is mitigation, not guarantee, because of an unresolved dispute. The cautionary position, advanced by OWASP in mid-2026, is that the vulnerability is baked into how language models read text and that no patch has closed it11. Real 2026 vulnerabilities show defences turned inside out: an allowlist becoming the attacker's instrument when poisoned environment variables turn approved commands into payload carriers, and an agent's own output redefining its sandbox boundary11. If the pessimists are right, no identity or policy layer can promise prevention — only containment.

05 Why "smart" guards can be weaker than dumb ones

A tempting design has an AI "guardian agent" judge another agent. The analyst community treats this as a real, fast-growing category — the "protector" type adjusts or blocks agentic actions during operation12. But putting a model in the judge's seat imports the fragility it claims to fix: monitoring-based defences can be bypassed, and even frontier-scale monitors can be defeated by agents of similar capability13. The trade-off is measurable — a rules-plus-model hybrid cuts missed attacks roughly tenfold at the cost of modest added friction, while a pure-model judge shows a systematic bias toward over-escalation, blocking routine but non-canonical commands14. Guardians also need governing themselves: metagovernance controls are required to prevent misalignment and operational risk from the guardians15single source · secondhand. For high-stakes actions, prefer a deterministic, externally-enforced gate over an intelligent supervisor.

06 The multi-agent twist, where current tooling breaks

One agent handing a task to another is where the standards run out. One-hop delegation works; recursion does not — the moment delegation becomes recursive the authorization chain loses its anchor, and no deployed protocol can cryptographically prove which human authorized which agent to take which action at the third or fourth hop16. The contagion risk is direct: when Agent A shares credentials with Agent B, B inherits A's full access with no way to scope or revoke it17. The promising but pre-production fix is holder-side attenuation — macaroon-style tokens that can only narrow scope downstream18 — but as of 2026 no single draft unifies holder-attenuable delegation, cross-protocol binding and provenance tracking19. The practical stopgap is a broker between agents: a runtime authorization layer that decides at the moment of tool invocation, independent of whatever token the agent holds20.

07 Proving it works, and proving it is worth it

These are two separate burdens.

Efficacy

The standard test metrics are the share of injection attempts blocked (target above 99%) and the false-positive rate of legitimate requests wrongly flagged (target below 2%)21. But benchmark scores are not operational reliability: a model that classifies 94% of alerts correctly may still execute containment on the ones it should have ignored22. Note a sourcing divide — vendor materials lead with clean thresholds and sub-200ms latency23, while independent and academic sources stress calibration over benchmark precision2214. Trust the latter for procurement.

Cost

The enforcement engine itself is cheap; the costs sit in latency, false-positive friction and the production "last mile" — moving from 80% pilot accuracy to 99%-plus production accuracy takes roughly 100× more effort24single source. And the business case is shaky: 95% of enterprise AI pilots delivered zero measurable ROI25single source, while enterprises spend an estimated 17× more on AI tools than on securing AI itself26single source.

08 Why this is now law, not best practice

Proof of prevention became a legal requirement under the EU AI Act, enforceable for high-risk systems from 2 August 2026. The Article 12 logging obligation requires that every agent action be recorded automatically with identity, action, input, output and context; be tamper-evident through cryptographic measures; be retained at least six months; and be independently verifiable so auditors can confirm records were not altered without relying on the operator's assertion27. Penalties are material — up to €15 million or 3% of worldwide annual turnover, whichever is higher28.

Enforcement and audit turn out to be the same act. A governance layer that only observes logs after the fact is already out of compliance for high-risk systems.29

The record must capture not just what the agent did but what the governance system decided about it, including the policy version then in force30. This is the same in-path gate from Section 03 — efficacy, auditability and compliance all demand the identical architecture.

09 Where in the market this control sits

Not in the identity provider. The IdP does authentication; it is not a governance platform — Okta and Microsoft Entra handle authentication and basic lifecycle, but are not full identity governance platforms31. The legacy login-time model assumes bounded human intent and manageable identity volume32, both false for agents.

The centre of gravity is privileged-access management and identity governance, converging into a runtime control plane. The clearest market signal is capital: Palo Alto Networks' acquisition of CyberArk reflects that identity and privilege are now foundational to agentic security — platform vendors do not spend that to fill feature gaps, they do it to control a control plane33. The product reality is shipping: SailPoint's Agentic Fabric extends an existing identity graph so its protection layer adds real-time authorization enforcement34, though agent coverage is typically a separately-licensed add-on module rather than part of the base platform35single source. The emerging dedicated category is framed as an "Okta + SailPoint for agents": a centralized broker that shifts governance from who a human is to why an agent is acting, issuing task-scoped permissions only when an authorized action is requested or in progress32single source.

10 Two open risks a buyer should plan around

Category durability

Independent agent-control products are forecast to be absorbed. Gartner expects rapid consolidation as large vendors acquire AI-security startups and embed their controls into unified platforms, and predicts that by 2029 independent guardian agents will eliminate the need for almost half of incumbent systems intended to protect AI agent activity in over 70% of organizations15single source · secondhand. The acquisition cadence is already relentless — CyberArk acquired Zilla Security, then was itself acquired by Palo Alto Networks31; Thoma Bravo owns both SailPoint and Ping Identity, raising questions about roadmap independence36.

Lock-in

Open protocols solve the integration tax but not control-plane dependency. MCP is the de-facto tool-connection standard — on the order of 97 million monthly downloads, 10,000-plus public servers, support from every major provider37 — and the protocols now sit under neutral Linux Foundation governance, the most important structural fact of early 202638. But if agents run on a vendor's proprietary orchestration layer, lock-in compounds at every layer of the stack39. The defensive posture: fix the protocol layer as a stable substrate and keep the enforcement vendor swappable, since the protocols have neutral governance while the vendors are consolidating.

11 Five things to remember

1. Identity tells you who; it does not control what. Naming an agent is the start of the problem, not the solution46.
2. Control is a runtime, in-path, externally-enforced gate. Anything inside the agent's own process can be bypassed107.
3. Enforcement and audit are the same act, and law now requires it for high-risk systems2927.
4. The control plane is PAM/IGA-lineage, not the IdP3133.
5. Two caveats cap all of it: prompt injection may be structurally unfixable11, and the strongest market figures are uneven and partly secondhand — treat the numbers as directional.

12 Where the experts genuinely disagree

These splits are not resolvable from the available sources and should be held open.