AI governance: five proofs of control

In the first half of 2025, the security vendor Entro Security (Israel · Entro Security) counted 144 non-human identities for every human identity in the enterprise environments it analyses, up from 92 to 1 a year earlier. Service accounts, API keys, tokens: every AI agent adds more. In its 2026 playbook on AI governance, the French software company Dust (France · Dust) draws a conclusion for executive teams: “shadow AI” is now accepted; what remains is to prove that AI is under control.

A policy document proves nothing. What now matters is being able to show, logs in hand, who did what and through which agent. Our Clairancy white paper sets out the approach in detail; here is the essence.

What is already settled

• AI literacy (EU · AI Act, Article 4): since 2 February 2025, providers and deployers have taken measures to develop their staff’s AI literacy. Regulation (EU) 2026/1744, in force since 27 July 2026, reworded the obligation without removing it.
• Transparency (EU · AI Act, Article 50): since 2 August 2026, deployers must disclose deepfakes and generated text published to inform the public on matters of public interest, unless it has undergone human review under editorial responsibility.
• Automated decisions (EU · GDPR, Articles 22 and 35): the right not to be subject to a solely automated decision with significant effects; an impact assessment is mandatory where the risk is high.
• Agentic AI (France · CNIL and CIANum): on 20 July 2026, an exploratory note confirmed that agents remain subject to the GDPR and proposed isolating their memory, sandboxing them, providing an emergency stop and requiring human validation for critical decisions.
• The lethal trifecta (international · Simon Willison): on 16 June 2025, the developer described the combination that makes an agent exploitable by an attacker.
• A supply chain attack (United Kingdom · The Register): in September 2025, a fake MCP server for an email delivery service added, in its version 1.0.16, a hidden copy of every message to an external address.

What is coming

• 2 December 2026 (EU · AI Act): end of the grace period for providers of generative tools already on the market to mark the content they produce.
• 2 December 2027 (EU · AI Act): obligations for Annex III high-risk systems (recruitment, worker management, credit, education). Deployers will notably have to assign human oversight to competent people and keep logs for at least six months.
• 2 August 2028 (EU · AI Act): obligations for high-risk systems built into regulated products (Annex I).

The real issue: five proofs, not a policy

Dust’s playbook organises CISOs’ concerns around attribution, data leakage and control. From them we draw five proofs an executive team must be able to produce.

1. Attribution: every agent action is linked to a person, to the agent itself, to its rights and to the data it read. That is an audit trail, not a usage dashboard.
2. Data control: what may go into an AI tool, what must never leave, and with which supplier. The playbook points to the legal exposure, from the GDPR in Europe to the CCPA in California.
3. Access control: add, remove, grant, revoke, then check that the map of rights is right. The playbook’s example: no path should lead from finance to health data.
4. Group-based rollout: single sign-on (SSO) and automated provisioning (SCIM), connectors and secrets reserved for administrators, restricted spaces.
5. Outbound traffic: agents only write to approved addresses, and every third-party component is vetted.

With 144 machine identities per human identity, these proofs can no longer be produced by hand. An identity with no owner and no expiry date is access that nobody will be able to revoke.

Three points to watch

1. The lethal trifecta. According to Simon Willison, an agent becomes dangerous when it combines access to private data, exposure to untrusted content (a web page, an inbound email) and the ability to communicate externally. A single booby-trapped text is then enough to make it send internal data out. Filters are not enough: in security, blocking 95% of attacks is still a failure. Dust’s proposed answer: split the roles between a research agent with no internal access, a drafting agent fed with structured inputs and a guarded orchestrator.

2. Borrowed credentials. When an agent acts with an employee’s account, the logs only record the employee. Dust’s playbook points out that the agent’s involvement then vanishes from the trail. The CNIL and CIANum note makes the same observation: without traceability of every step, responsibility becomes hard to establish.

3. The supply chain. Remote MCP servers, downloaded skills, models, sub-processors: every link is a supplier. The September 2025 case shows that a simple update can turn a trusted component into an exfiltration tool.

What an executive team should demand

1. A complete inventory of tools, agents, connectors and non-human identities, including outside approved tools.
2. A tested audit trail: reconstruct, within twenty-four hours, three agent actions picked at random.
3. An owner and an expiry date for every non-human identity.
4. Group-based access, withdrawn automatically when an employee leaves.
5. A trifecta check for every agent before it goes into production.
6. An allow-list for outbound traffic and for connectors.
7. A 90-day evidence file: register, impact assessments, contracts, log extracts, training records.

Controlled AI is AI whose every action can be reconstructed.

The question to ask on Monday morning

To your CISO: “For an action one of our AI agents carried out yesterday, how long would it take us to say who requested it, with which rights and on which data?”