Most people think brakes are just for slowing down. Racecar drivers know that they are actually what allows them to go faster because they provide the control needed to take corners at speed. As organizations sprint to adopt AI, those operating without governance are essentially flooring it blindly into a corner.
But building those brakes requires moving past theoretical ethics and corporate platitudes. The Hugging Face incident showed that this risk is no longer hypothetical: during internal cybersecurity evaluations, autonomous agents circumvented isolation controls, exploited vulnerabilities and accessed third-party systems without being directed to do so. Subsequent disclosures suggest this may not be an isolated breakdown but part of a broader pattern of agents exceeding their intended scope faster than existing monitoring and incident-response processes could contain them.
Putting guardrails in markdown files does not control autonomous agents. LLMs are probabilistic, not polite. In the black box of AI logic, the mathematical reward for completing a task can easily override a text prompt to avoid it.
If we want to safely harness the immense speed of this technology without spinning out of control, it’s time for a mature conversation about what real, enforceable AI guardrails actually look like.
Security governance vs. AI governance
Recent reports about Australia’s Medicare statistics portal and an OpenAI autonomous agent are sounding a massive wake-up call. As reported by the BBC, an experimental model appeared to bypass security controls, and the company took nearly three months to report it. This is an alarming example of what happens when AI systems begin operating at machine speed and existing governance frameworks are caught completely flat-footed.
Once aware, the Australian government moved quickly to strengthen cybersecurity controls across government systems while the incident is investigated. That’s a sensible response. But it also points to the larger issue: security incidents are not always about whether technology is old or new; more often, they’re about exposure. The exposure problem comes down to which systems an AI agent can access, whether permissions and monitoring impose meaningful limits on that access, and how quickly a weakness can be discovered and exploited at machine speed.
This is why organizations need both strong security governance and strong AI governance. Security governance determines what an AI agent can access, while AI governance determines what it is allowed to do. As AI becomes more deeply connected to enterprise systems, success will depend on both. The conversation should be less about the age of the technology and more about how organizations govern data, manage access and control the growing web of systems, APIs and AI services that now shape the modern enterprise.
That doesn’t mean we should run away from AI screaming and bring innovation to a halt. What organizations need are controls that match the pace and reach of the technology, with clear accountability before deployment and continuous oversight once systems are operating.
How did we get here with AI and governance?
The pressure to move quickly is understandable. Business leaders see AI as a path to greater productivity, faster decisions and new customer experiences. Technology teams are being asked to take AI from proof of concept to production while the underlying models, vendors and architectures continue to evolve.
In many organizations, experimentation has advanced faster than governance. Processes for approving use cases, classifying data, assigning accountability and monitoring behavior often lag behind deployment. Even companies without a formal AI strategy may already have AI embedded throughout their environment through employee use of public tools, vendor copilots, developer integrations and business-led technology purchases. In racing terms, the engine has been upgraded, but too many organizations still lack the steering, braking and telemetry to keep AI on course.
The result is a growing readiness gap. Organizations understand the opportunity, but many acknowledge that their ambitions are outpacing their ability to govern data, manage risk and maintain oversight.
Navigating the growing AI risk landscape
AI is proving to be both an offensive and defensive capability. The same technology that helps attackers move faster can help defenders identify threats, automate responses and reduce the impact of incidents. The difference is not the technology itself, but the controls surrounding it.
Cybercriminals are using AI to accelerate familiar attack techniques, while employees and business teams are creating new pathways for data to move through AI-enabled services. Every new integration, API and connected agent creates another intersection that must be governed. Without visibility, organizations can lose track of what data is moving, where it is being sent and how it is being used.
This is why focusing solely on the AI model misses the point. Security incidents rarely occur because a model exists. They typically occur because the model has been connected to an environment with weak access controls, excessive permissions, exposed interfaces or unclear ownership. AI simply reaches those weaknesses faster and more persistently than a human user could.
AI agents raise the stakes even further. Traditional AI systems provide recommendations; agents can take action. They can execute workflows, access systems, update records and trigger downstream processes without direct human intervention. Giving an AI agent access to your enterprise without governance is like putting a Formula One driver in a race car with no brakes. The issue isn’t that the car can go fast. The issue is that there is nothing controlling where it goes, what it can access or how it responds when conditions change.
That’s why governance can no longer be treated as a compliance exercise performed after deployment. In the age of Agentic AI ERP, governance is the braking system. The more powerful the technology becomes, the more important it is to know where it can go, what it can touch and how quickly you can bring it under control when something unexpected happens.
Getting ahead of AI risk with strong governance
Effective AI governance should make responsible innovation easier, not bury it in process. The goal is to create a repeatable path from idea to production that gives business teams room to move while giving security, legal, data and technology leaders the evidence they need to manage risk.
These controls must also reach beyond internally developed AI. Procurement standards and contracts should establish vendor obligations for data handling, model changes, incident notification, audit evidence and subcontractor risk. Otherwise, an organization may inherit material AI exposure without having direct control over the system that creates it.
Shadow AI deserves particular attention. Blocking every public tool may drive usage further underground, while unrestricted access creates obvious data risk. A more sustainable approach combines clear usage policies, approved alternatives, corporate accounts, data loss prevention (DLP) controls, employee education and monitoring that can distinguish legitimate experimentation from dangerous behavior.
Finally, governance must address machine identities. Agents should have scoped credentials, time-bound access, attributable actions and a defined human owner. High-impact steps may require human approval, and automated systems should have enforceable limits on spend, data access, transaction volume and the systems they can reach.
How Rimini Street helps organizations build their governance framework and scale their operating capability
Building the framework is only the beginning. Many organizations can define policies but struggle to translate them into controls, evidence and day-to-day operating routines. The challenge becomes more acute as AI use expands across functions and vendors, leaving already stretched teams to coordinate security, data, legal, compliance and business stakeholders.
Rimini Govern™ for AI is designed to help close that gap by turning governance into an ongoing managed capability. The approach can support clients across a Plan, Implement and Operate lifecycle: establish priorities and accountability; translate policies into technical and procedural controls; then monitor, measure and improve those controls as AI systems and risks evolve.
Within that lifecycle, a Define, Validate and Certify discipline can create consistency at the use-case level. Organizations define the intended outcome, data boundaries, acceptable behavior and owner; validate the system against security, governance and performance requirements; and certify that it is ready for an approved level of operation.
Rimini Street, as the 20-year global leader of software support, managed services and Agentic AI ERP innovation, introduced an end-to-end set of services to design, deploy, govern and optimize AI agent operations across mission-critical enterprise environments: Rimini Agentworks™, Rimini Agentic UX™ and Rimini Govern™ for AI.
- Rimini Agentworks helps move AI agents from concept to trusted production
- Rimini Agentic UX enables AI-driven user engagement and workflow automation
- Rimini Govern for AI provides managed governance, security, monitoring and measurement for agents in operation.
The combination provides organizations with a clearer, safer route to value: fewer unknown AI deployments, stronger control over enterprise data and agent actions, faster evidence-based approvals and greater confidence that innovation can scale without creating unacceptable operational or regulatory exposure.
Govern at the speed of AI
The recent incidents are a warning, but they are not an argument against AI. They are an argument against deploying powerful systems without equally capable governance. Organizations that treat AI as a one-time technology purchase risk losing control as models, agents, integrations and threats continue to evolve around them. Those that build governance into the operating model can move faster with more confidence because they know what is approved, what is monitored and where human judgment must remain in control.
For organizations trying to move quickly without losing control, the next step is understanding where governance gaps already exist. Schedule a complimentary Rimini AI Readiness Assessment to help you identify and mitigate governance gaps and define next steps for scaling your AI initiatives.
