AI Governance Institute
← News
Research2026-09-16

NHIMG: LLMs and Agents Must Be Governed as Privileged Workloads

What happened

The National Healthcare Infrastructure Management Group (NHIMG) published LLM security risks in 2026: prompt injection, MCP and agent abuse, a practitioner guidance document covering how LLMs and AI agents create a new class of privileged access risk. The document argues that agents must be treated as privileged workloads with dedicated non-human identities, server-side authorization, and schema validation on every tool call -- not as chat interfaces governed by content policy alone. It specifically addresses the Model Context Protocol (MCP) as an uncontrolled trust boundary where prompt injection and credential abuse converge. The guidance connects three control domains that are often siloed: model risk management, identity and access governance, and step-up approval for sensitive operations. This analysis builds on a growing pattern of MCP-specific exposure documented across the industry, including 91.8% of audited MCP servers lacking OAuth and 68 MCP server CVEs filed in a single month.

Why it matters

  • ·Enterprises that govern AI agents as software applications rather than privileged actors will have structural IAM gaps. Non-human agent identities require the same credential lifecycle, scope limits, and audit trails that apply to human privileged users -- controls most programs have not yet extended to agents.
  • ·The guidance places MCP directly in the compliance control surface. Every MCP server an enterprise connects to an agent is now a governed dependency: it requires authentication verification, schema validation, and supply chain risk assessment under frameworks like OWASP Top 10 for Large Language Model Applications.
  • ·Step-up approval gates for sensitive agent actions -- account changes, code execution, data access -- are identified as a baseline control, not an advanced one. Compliance teams that have not mapped which agent actions cross this threshold are exposed if an incident occurs and no approval record exists.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-005Human Approval Gate for Irreversible Agent ActionsAGT-009Agent and Non-Human Identity ManagementAGT-015Agent OAuth Scope Drift DetectionAGT-019AI Tool and Plugin Supply Chain Risk AssessmentAGT-026Mid-Task Agent Intervention ProtocolAGT-030MCP Server Inventory and Configuration Baseline

What to do now

  • ☐Audit every deployed AI agent to confirm it holds a dedicated non-human identity with scoped credentials -- flag any agent running under shared service accounts or user credentials.
  • ☐Map which agent actions qualify as sensitive operations (account changes, code execution, data writes, external API calls) and verify that step-up approval gates are enforced at the server or platform layer, not just in the model prompt.
  • ☐Review all connected MCP servers against authentication requirements: confirm OAuth is configured, schemas are validated, and each server is inventoried as a governed dependency with a named owner.
  • ☐Assess whether existing IAM policies explicitly cover non-human AI actors -- update privileged access management procedures to include agent credential rotation, scope limits, and revocation workflows.
  • ☐Add MCP server intake to your third-party AI vendor due diligence process: require authentication documentation and vulnerability disclosure history before connecting any new MCP server to a production agent.

What to watch next

Compliance teams should monitor whether MCP authentication requirements harden into binding baseline expectations through standards bodies such as CSA and OWASP, both of which have recently published agent security guidance that references server-side authorization. Regulatory uptake of non-human identity requirements is also accelerating: CISA's agentic AI guidance and the Five Eyes Guidance on the Careful Adoption of Agentic AI Services both signal that privileged-workload framing for agents is moving toward enforceable norms. Teams should also watch whether NHIMG's earlier OAuth registration standard is adopted as a procurement condition by regulated sector buyers, which would create downstream vendor compliance obligations.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Corporate Policy2026-10-24

Email Prompt Injection Turns Trusted AI Agents Into Attack Tools

Gen Threat Labs published research showing AI agents can be redirected by malicious instructions embedded in ordinary email content, with no software flaw required. Gen Digital responded with the Agent Trust Hub, a layered security framework covering pre-installation scanning, encrypted agent connectivity, and runtime action interception. The accompanying AARTS open specification sets a proposed standard for agent runtime safety that enterprise teams can reference.

Corporate Policy2026-10-23

1Password Launches Agent Login Controls, Exposing Identity Gap at Scale

1Password has launched a product called 1Password for Agents that lets AI agents log into services on behalf of users without ever receiving or storing the underlying password. Each login attempt requires explicit user approval. The product addresses a growing enterprise control gap: most organizations running AI agents have no structured way to track or limit what those agents can access.

Research2026-10-26

90% Hijack Rate Turns AI Coding Agents Into Attack Tools via Download Folder

Researchers at Forever Security demonstrated that placing a malicious instruction file named AGENTS.md in a user's Downloads folder can hijack AI coding agents, including OpenAI Codex and Claude Code, to execute arbitrary commands. The attack succeeded 90% of the time in testing. Neither OpenAI nor Anthropic can patch the behavior because it exploits how these agents are designed to work, placing the entire defense burden on enterprise operators.