Enterprises Urged to Move From AI Discovery to Enforcement as Shadow Agents Outpace Controls

The article says enforcement means changing the outcome of an AI action while it occurs, not reporting on it afterward. For an agent, it identifies four possible interventions: block the tool from running, scope down what it can reach, gate a specific action behind approval, or terminate the process mid-execution. Those choices are not interchangeable, and the article says choosing among them is most of the work. Blocking is blunt and generates complaints, scoping is durable but hard to configure, gating can become a formality, and termination is a last resort that must happen before the action completes.

Network-level blocking of AI domains has been the first control many organizations try, because it is easy to deploy and explain, but the article says it stops a shrinking share of the risk. AI is no longer just a website. Local models make no outbound call to inspect. Embedded copilots run inside licensed applications, so their traffic resembles an approved vendor. IDE and command-line agents, along with MCP servers on localhost, never cross a network boundary the organization controls. Personal devices remain an old gap and have become worse as AI tools become free and widely available.

The article points to a permissions problem beneath those gaps. An agent acts using a human's identity and entitlements, so logs may show that an employee read a file, or a credential may belong to a person or service account provisioned for another purpose. Existing identity controls ask whether that principal is allowed to perform the operation, and the answer is usually yes. The article says the question identity infrastructure was not built to answer is whether an action taken by software on the human's behalf is one the human would have sanctioned. Emerging standards such as AIUC-1 treat unauthorized agent actions, access privilege enforcement, and unsafe tool calls as separate controls rather than folding them into general access management.

Enforcement must sit at the point where an action executes, the article argues, because that is the only place the decision is deterministic. Controls at the instruction layer, including input filtering and prompt guardrails, evaluate text before it reaches a model. The article says they are worth deploying and can reduce volume, but they are probabilistic, and separating instructions from data inside a language model remains unsolved. Organizations should therefore build for the case where an instruction gets through. If a tool call is scoped, gated, or stopped when it fires, the origin of the instruction stops mattering. A malicious prompt, a poisoned document, and an honest mistake can all produce the same blocked action. The article says endpoint and runtime placement keeps winning the architecture argument because nearly every AI interaction eventually becomes a process on a device, where a local model, an embedded copilot, and a browser tab all look like what they are: code executing.

For organizations starting enforcement, the article recommends sequencing projects to fail quietly rather than loudly. It suggests picking one category rather than the whole inventory, such as a small group of prohibited tools with an obvious sanctioned replacement. It recommends running in monitor mode for two weeks to find the legitimate workflow nobody mentioned. It says every agent should have an owner before enforcement begins, because an unowned agent cannot be exempted or fixed and a block can become an incident. It advises turning on blocking for the smallest viable scope and measuring the complaint rate before expanding, and wiring the enforcement log into the evidence pipeline from day one because retrofitting is harder than building it in.

To make the case to leadership, the article says to lead with a number executives will not like: the count of AI agents running with no owner, no logging, and no control. That number is usually large enough to fund the program by itself, it says. It then recommends committing to a second number: enforcement actions taken in the first quarter, broken out into blocks and approvals. A control that never stops anything is not a control, the article says; it is a report with better branding. The article contrasts discovery, which produces a list, with enforcement, which acts on it.

Editor's Summary

The TechRadar column argues that enterprises have largely completed shadow AI discovery but have not moved to enforcement, leaving many agents without oversight or logging. It recommends real-time interventions at the point of execution, because network blocking and existing identity controls often miss agents that act with human credentials. It also offers a phased approach for starting enforcement without disrupting legitimate workflows.