The finding
Delinea's 2026 Identity Security Report draws on a global survey of 2,254 IT and security leaders. It reports that 99.7% of organizations have a formal policy governing AI data access, while only about half check access against policy in real time. The report says 87% saw an AI tool or agent access sensitive data beyond its intended scope in the prior year, fewer than one in five could detect a scope violation as it happened, and only 36% could always trace sensitive AI access to a named human authorizer. CI/CD pipelines and Kubernetes were among the weakest enforcement environments.
The authority problem
Policy existence is not authority enforcement. Agents can inherit permissions accumulated by the human who launched them, while credentials can remain usable after assigned work ends.
The authority-layer answer
Runtime authorization should determine whether this exact action is authorized now under a current mandate, delegation, target, constraints and time window. Session end, task completion, mandate expiry or revocation should terminate effect authority independently of credential lifetime.
Why this matters
AI governance is moving from documents to enforcement. The decisive control point is whether policy can become machine-verifiable authority at the moment an autonomous system acts.
Sources
https://delinea.com/news/2026-identity-security-report-the-ai-enforcement-gap
NEXT STEP