AI Governance Institute
← News
Research2026-09-16

Accountability Gap in AI Agent Governance: Who Owns the Gateway?

What happened

The National Hyperscaler and Infrastructure Management Group (NHIMG) published Who is accountable for AI agent risk when prompts, tools, and MCP traffic are governed?, a practitioner guidance note addressing a structural gap in how enterprises assign ownership over agentic AI risk. The paper frames the gateway between an agent and its connected tools or MCP servers as the accountability boundary. It argues that ownership should be assigned by function rather than title, because the person or team that controls the gateway is the one who can actually enforce, restrict, or audit what the agent does. The guidance identifies three specific ownership questions that most programs leave unanswered: who is responsible for enforcing controls at runtime, who holds exception authority when a control is bypassed, and who produces the evidence that every control is active in production rather than only documented in design artifacts. This follows a pattern of NHIMG guidance, including NHIMG: Agentic AI Governance Must Shift to Action-Level Runtime Controls and NHIMG Guidance Makes Task-Scoped OAuth Tokens a Baseline IAM Control for AI Agents, that consistently highlights the gap between documented policy and enforced practice.

Why it matters

  • ·Regulators and auditors increasingly expect named functional owners behind AI controls, not just documented policies. An enterprise that cannot identify who enforces agent permission boundaries or approves runtime exceptions will struggle to demonstrate compliance under frameworks like the EU AI Act Implementation Timeline or sector-specific model risk guidance.
  • ·The gateway-as-accountability-boundary framing has direct operational consequences. If the team that manages MCP server connections is not formally designated as the accountable function, incident response is slower, exception handling is ad hoc, and the five-July-2026 pattern of trust boundaries declared but not enforced will repeat.
  • ·Organizations that have completed agent governance policy work but have not mapped enforcement ownership to specific functions now have a documented gap. A regulator or plaintiff's counsel examining an agentic AI incident will ask who was responsible for production-level control evidence, and 'the policy team' is not an adequate answer.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-005Human Approval Gate for Irreversible Agent ActionsAGT-006Agent Action Audit TrailAGT-009Agent and Non-Human Identity ManagementAGT-027Agent Ownership and Accountability RegisterBRD-002AI Governance Committee Charter and Decision Rights

What to do now

  • ☐Map each active MCP server and agent tool connection to a named functional owner, not just a policy document owner, within 30 days.
  • ☐Establish a written exception authority register that identifies who can approve deviations from agent permission boundaries and under what conditions.
  • ☐Require production-level control evidence (logs, runtime attestations, or automated monitoring outputs) for every agent control listed in your governance program, and assign a named function responsible for producing that evidence on a defined cadence.
  • ☐Review your AI governance committee charter to confirm it includes explicit decision rights over agent-layer controls, including gateway ownership assignments and escalation paths.
  • ☐Test your incident response playbook against a scenario where an MCP-connected agent takes an unauthorized action: verify that the accountable function is reachable and that exception criteria are pre-defined.

What to watch next

NHIMG has been publishing a sequence of practitioner guidance on agentic identity and runtime controls, and further installments addressing MCP authentication and multi-agent delegation are likely. Compliance teams should also watch for regulatory signals that codify gateway-level accountability requirements: the Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents in China and the Five Eyes Guidance on the Careful Adoption of Agentic AI Services both gesture toward deployer-side ownership obligations that this NHIMG framing anticipates. Enforcement patterns emerging from the EU AI Office's GPAI monitoring work are also worth tracking, as they may translate accountability-by-function expectations into audit evidence requirements for enterprises with agent deployments in scope.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Enforcement2026-09-28

FTC Chair Warns AI Agent Deployments Face Liability for Harm and Nondisclosure

FTC Chair Andrew Ferguson stated the agency will enforce consumer protection laws against companies that fail to disclose AI agent use or whose agents cause consumer harm. The remarks signal that the FTC views AI agents as company conduct, not independent actors, making deploying enterprises directly accountable. No new rule was announced, but the enforcement signal applies under existing FTC authority.

Corporate Policy2026-10-01

Microsoft Entra MCP Firewall Makes Agent Traffic Control a Named Governance Requirement

Microsoft has previewed an Entra MCP Firewall that gives administrators centralized visibility and policy control over traffic between AI agents and external tool servers. The guidance pairs the firewall with requirements for unique agent identities, time-limited access elevations, tool allowlists, and full logging. The announcement marks the first major identity platform vendor to ship a named product addressing the agent-to-tool control gap.

Corporate Policy2026-09-30

AI Agents Running as Users: Rig Security's $12M Launch Exposes an Identity Control Gap

Rig Security has launched from stealth with $12 million in seed funding to address a gap created by AI agents that act under human user permissions. Its platform distinguishes between legitimate human actions and agent actions at runtime, enabling targeted blocking without disrupting the underlying account. The launch highlights a structural control weakness that governance teams have not yet closed.