An AI governance program is how an organization decides which AI it uses, who may connect it to what, and how its risks are tested and reviewed. The experts are still catching up, so the program cannot wait for a finished playbook: start with inventory, training and access controls now.
The Year the Experts Ran Out
I've been in the IGA world for more than 12 years and have attended many conferences like SailPoint Navigate 2026 in Austin, which I just returned from. This was the first year I left a conference realizing we no longer have experts. The industry has moved so fast that, collectively, even the best and smartest people in it are behind.
What We Used to Be Experts In
In the past, the focus was on topics like just-in-time provisioning, where literally hundreds of people had implemented it. They knew the value, the shortcomings, the corner cases, the considerations, how to make it successful, the ROI, and the improved user experience. We were experts. Joiner/mover/leaver processes, satisfying auditors, business workflow automation: we had done it many times, and these conferences were a place to share our collective expertise and learn from each other.
This year was different. The message from the main stage was one I completely agree with: move fast. The keynotes laid out a sound high-level strategy of detect, govern, and remediate. What none of them could offer yet was the playbook underneath that strategy, because that playbook does not exist anywhere in the industry yet. Not at the vendors, and not at the consultancies, ours included.
What the OWASP List Taught Me
On my way to the event, I picked up an online course on the OWASP Top 10 for LLM Applications, the OWASP Gen AI Security Project's list of the most critical risks organizations need to address to secure their use of large language models. Having been immersed in using AI tools for several years now, I hadn't stepped back to take a more formal, education-first approach, and it was eye-opening.
Detection Is Step One
I'm excited to see emerging detection technologies like SailPoint's acquisition of Entro Security and its non-human identity discovery. Detection is absolutely critical, and I think Entro may turn out to be the best investment SailPoint has ever made. But the step after detection is what gives me pause. The OWASP course showed me the many layers of vulnerability that exist with each AI agent, MCP server, and non-human identity that tools like Entro can detect. Five of the six questions it left me with map to a named risk:
- Was the training data poisoned? LLM04:2025 Data and Model Poisoning.
- Are you protected against prompt injection? LLM01:2025 Prompt Injection.
- Have you documented where your models were sourced? LLM03:2025 Supply Chain.
- Do you have access controls in place? LLM06:2025 Excessive Agency, where an agent holds more functionality, permissions, or autonomy than its job needs.
- Where did your RAG data come from? LLM08:2025 Vector and Embedding Weaknesses.
- Are you red-team testing? Not an entry on the list itself. OWASP covers it in separate GenAI red-teaming guidance, and it is how you find out whether your answers to the other five are true.
Shadow AI Is Already in the Building
For the CISOs I've spoken with about AI over the past year, the primary focus has been keeping control of shadow AI in their organizations. Picture a junior accountant with a Claude account who builds an MCP server to the company's financial system in an hour. Does anyone believe they have the security training to do it properly? With detection technology, we can now find where these systems exist. But an entire industry of AI governance now needs to emerge at a speed we've never seen before. We can't put on the brakes. Boards see AI as a competitive advantage, which it is, but as always, security is going to be an afterthought.
Many areas of AI are unsettling, and I left this conference unsettled that, collectively, we aren't the experts anymore. It's like we're all driving on the Autobahn without seatbelts because cars just came out and they're fun as hell to drive.
The First 90 Days of an AI Governance Program
Nobody has the finished playbook, but you don't need one to start. If I were standing up an AI governance program this quarter, these are the five things I would put in place first.
- Inventory, including shadow AI. List the AI your organization uses: the sanctioned tools, the agents, the MCP servers, and the ones people adopted on their own. Detection tools find the non-human identities these systems run under, and an IAM assessment puts them in the context of your whole program. Finding unsanctioned tools also takes endpoint and software spend data.
- Ownership. Give every AI system, agent, and MCP server a named, accountable owner and a review date. If nobody owns it, nobody will ever turn it off.
- Risk tiering against the OWASP list. Rank each system by the data it can reach and the actions it can take, then work through the OWASP Top 10 for LLM Applications for the highest tier first.
- Training. Start AI governance training for the people who build, not only the people who approve. The accountant with the MCP server is the audience. And keep the sanctioned path fast: if approving a new AI tool takes a quarter, people will build their own.
- Access controls on agents and MCP servers. Treat the accounts and keys an agent uses like any other privileged identity: least privilege, a reason for every entitlement, and a way to revoke it. Our AI Identity Governance Assessment measures how well you can account for those identities, and testing an MCP server's permissions before it reaches production is one control worth adopting early.
If you want a frame to hang this on, the NIST AI Risk Management Framework (NIST AI 100-1) organizes the work into four functions: Govern, Map, Measure, and Manage. Inventory, ownership and training sit under Govern (GOVERN 1.6 calls for mechanisms to inventory AI systems), risk tiering under Map, red-team and security testing under Measure, and access controls under Manage. It is the same discipline identity governance has applied to people for years, extended to software that acts on its own.
Start the Program Now
My message to anyone reading this: your organization needs to create an AI governance think tank or program immediately. Train your people on these risks. Start overseeing your use of AI and build a governance program around it, and it needs to happen yesterday.
The industry will catch up. Assuming the pace of the technology levels off somewhat, we will become experts on today's AI capabilities in the next few years. But it's going to take time for the industry's skills to keep up, and your program shouldn't wait for them.