Ask most IT managers whether their company has an AI policy and the answer comes fast. Yes, obviously, HR sent it round last quarter.
Then ask a harder question. What stops an employee’s AI agent from pulling a client list into a personal ChatGPT account? What stops an automated workflow from querying a database it was never meant to see? The answer gets slower. Usually it lands on some version of “well, the policy says not to.”
A policy tells people what they shouldn’t do. A guardrail makes the system unable to do it. Most companies have built the first and assumed it counts as the second.
A small agent that got bigger
Here’s the shape it usually takes. A finance team at a Dubai trading company builds an agent with a no-code tool. IT never signed off, because IT never knew. It reads incoming invoices, matches them against purchase orders in the ERP, and emails the finance manager a summary each morning. Useful. Boring. Not a security story.
Three weeks later someone extends it to flag invoices eligible for early payment discounts. That needs read access to the vendor banking details table, so someone grants it. No risk assessment gets updated, because there was never a risk assessment to begin with.
Widening an agent’s reach is usually a five-minute exchange in a chat channel. It is not a change request, and it does not go anywhere near security review. So the agent ends up sitting on standing access to banking data off the back of a decision nobody outside that team knows was made. What keeps it in its lane from that point on is the assumption that it will carry on doing what it was built to do.
The numbers behind it
Deloitte puts the share of organisations with a mature governance model for autonomous AI agents at roughly one in five. Netwrix found 76% don’t fully govern or monitor non-human identities, a category that now covers every AI agent inside the business, and only 11% rate themselves fully ready for AI with enforced policies and continuous monitoring.
Scale is the part that catches people out. IBM’s Institute for Business Value expects the average enterprise to be running 1,661 AI agents by 2027. Industry estimates already put agents at 25 to 50 times the number of human identities in a typical environment, against just 5.7% of organisations with full visibility into their service accounts.
Forrester’s 2026 CISO research pins down why that matters. Most security teams have no inventory of the agents running in their environment, and no access controls on the Model Context Protocol servers those agents use to reach other systems. Writing a policy for a population you have not counted is guesswork.
What enforcement looks like
A guardrail sits at the point of action, not in a document three departments away. When an agent goes to call a tool, send an email or run a query, the request gets checked against policy and either clears or stops there.
Platforms built for this tend to work in three layers. A governed agent builder locks model access, data scope and deployment rules into an agent as it’s created, so that invoice agent could never have reached the banking table without someone explicitly granting and logging it. A discovery layer hunts down the agents nobody approved, sweeping the SaaS copilots, cloud model platforms and automation tools where shadow AI piles up, on the assumption that your official inventory is incomplete. Then runtime enforcement catches the things that turn a useful agent into a liability, prompt injection being the obvious one, along with tool misuse and data walking out through an unmonitored connector.
Compliance is arriving faster than most governance programmes are being built, too. An agent touching customer data can pull a business into NIST’s AI Risk Management Framework, ISO 42001, SOC 2, HIPAA where health data is in play, and the EU AI Act’s transparency rules if any part of the business serves EU customers. UAE businesses carry PDPL obligations on top for personal data of residents, which is its own conversation separate from the global AI frameworks. Handling all that by hand, one framework at a time, is how compliance teams fall permanently behind. Better platforms produce the documentation as agents run, rather than rebuilding it from scratch whenever an audit lands.
Why so many stop at the policy
Not laziness. Writing the policy is the visible, fundable part of the job. It answers a board question, gives compliance something to point at, and looks like progress the week it’s signed.
Enforcement means inventorying every agent and connector and data source, then wiring controls into each one before anything ships. Slower work, harder to show off, and it usually loses the budget fight to whatever AI project is promising a return this quarter.
The awkward part is that enforcement is what keeps those faster projects alive. Forrester and Anaconda found 88% of enterprise AI agent pilots never reach production, with governance friction named by more than half of leaders as a top blocker, alongside evaluation gaps and model reliability. Agents built inside a governed environment from day one don’t need a retrofit. The ones built first and governed later stall when somebody finally asks who signed off on this and what it can touch, and unpicking access after the fact takes far longer than setting it properly would have.
Three questions worth asking today
Pick one AI agent running in your business right now. Who owns it. What can it reach. What would stop it going further than it should.
If the answer to the third one is a document, you have a policy. If it’s a system that checks and blocks in real time, you have a guardrail. Most businesses handle the first two questions fine. The third is where it gets quiet, and the companies that can’t answer it tend to get their answer during an incident instead.
iConnect’s AI security practice exists to close that gap. We map what’s already running in your environment, put real enforcement behind it, and tell you straight which of your controls are enforced and which are just written down. If you don’t know which you have, that’s worth sorting before the next agent goes live.
