AI Governance Tools vs an AI Audit: What Each One Actually Proves
This week’s agent-governance products sell detection and enforcement: they watch your agents, decide what they may do, and can stop them. An audit asks three different questions — who was accountable for a specific action, what was in scope, and what evidence survives — and buying the first does not produce the second.
WSO2 announced Agent Manager’s general availability on September 15, 2026; InfoQ covered it on September 18: “WSO2 has announced the general availability of WSO2 Agent Manager, an open-source platform designed to provide centralized governance, identity management, security controls, and operational oversight for AI agents running across different models, frameworks, and deployment environments.” Opal Security launched Opal Zero on September 17, 2026: “Opal Zero decides each agent request the moment it’s made, against the security team’s policy and organizational context, then enforces it as carefully scoped permissions in the gateway already in place.” iProov published HAPS — reported by Biometric Update on September 18 — an experimental specification for binding human presence and approval to a machine-readable action, with a partial reference implementation on GitHub and an invitation for critique rather than any reported deployment. That report draws the line that matters: “AI agents can access tools and services, but that does not prove a human intended or approved the actions they take.” SiliconANGLE’s September 17 report from Workiva’s Amplify event — sponsored-event coverage, not independent reporting — carried the finding from Josh Robinson, chief audit executive at Vast Space LLC: “Enterprise audit teams are finding that the evidence trail they depend on does not survive contact with AI agents.” TechTarget’s September 18 analysis of agent autonomy and CIO controls, and CIO.com’s September 18 round-up of sixteen governance tools, cover the same market from the buyer’s side. None of these products performs an audit or satisfies a regulator.
What each one leaves behind
Each row below is an artifact rather than a quality claim: what you would hand a reviewer or a client if they asked. Behind it sits the question the checklist’s new silent-delegation section asks of a specific agent.
| Aspect | What a governance tool proves | What an audit produces |
|---|---|---|
| AI agent inventory and scope | The register it keeps: the agents it has onboarded and the permissions it issued them. Its reach is its boundary — an agent nobody registered stays invisible to it. | A dated scope record per agent: which systems, actions and data are in bounds, which actions wait for a human, and who granted that authority and when — with live permissions that still match the page. |
| Monitoring and detection | Signals: policy violations, anomalous action patterns, and a dashboard of what the agents did. The evidence is a log entry in the tool’s store. | A test you can run unassisted: take one agent-initiated change and produce the approver, timestamp, target and outcome for it from records you already hold. |
| Least-privilege enforcement | The enforcement decision: what the gateway allowed or denied at the moment the request was made, against the policy you configured. | The authority behind whichever actions were allowed: the evidence that the person whose approval was required gave it, and that their remit covered this action. |
| Approval and override records | The approval step it ran and the record it kept: which policy fired, and which request passed through it. | The approval stored alongside the action itself, plus a documented reversal path: who can undo it, how, and how long a reversal takes to become possible — logged against the same entry. |
| Accountability attribution | Attribution as configured: an agent identity, a role, a policy, a team. | One accountable person attached to the agent record — a name, not a queue and not the vendor — with a stated split between the decisions it may take unattended and those that require a person. |
| Evidentiary retention and independence | Retention for the life of the licence, in a store the vendor operates, with export on request. | A retention period in writing that outlasts your incident-response cycle, in a store that sits outside the agent team’s control, still readable 90 days later, and held independently of the tool that produced it. |
A governance tool hands you its console, the policy you configured, an alert history and a log export while the licence lasts — artifacts describing what the tool saw, held in the vendor’s store; what it does not hand you is a record of authority, a named owner, or anything that outlives the subscription. An audit hands you the scope record, the approval record for a named action, the override path, the named owner and a retention commitment: documents that stand on their own when the tool is not in the room. Buy the tool for control: it is the fastest way to constrain what your agents can do this quarter. Commission the audit for evidence: what a reviewer asks for is not a dashboard but a record naming the action, the approver and the authority, carried by the person who answers for it.
Inventory is not assurance
Counting agents is the easy half. The checklist treats how many AI agents you have as a question with a dated record behind it, not a number produced once. "Visibility is an on-going issue because it means different things to different vendors," Ax Sharma, security researcher at AI agent security vendor Manifold Security, told BankInfoSecurity. "Some products count agents, some map their permissions, some watch what they actually do and buyers often assume one implies the others. Knowing an agent exists tells you nothing about what it did overnight with the credentials it inherited." The data shows the same split: 77.3% of organizations report high or very high confidence that they can see all human and non-human identities, while only 18.5% run identity discovery continuously or in near real time — the gap non-human identity management has to close (IDC Worldwide IAM Security Survey, May 2026, n = 860, unweighted; n = 860 is the percentage base — a separate instrument from the 13-person IDC panel). The second question is not "does it exist" but who owns it, what it may touch, and when it is shut off: "The hard part isn't finding the agent. It's deciding who owns it, what it's allowed to touch and when it gets shut off. That's the muscle nobody has built yet," said Mike Toole, director of IT and security at Blumira. For many organizations that second question is only asked under pressure — "the honest answer for many organizations is that discovery happens reactively, when an audit or an incident forces the question," Sharma said.
Do I need an AI governance tool or an AI audit?
An AI governance tool and an AI audit prove different things. The tool controls what agents may do while they run — permissions, detections, approvals — and keeps the log in its own store. An audit produces evidence you hold: who approved which action, under what authority. Buy the tool for control; commission the audit for evidence. Put as one purchase decision, the AI agent audit vs governance tool question is not either/or: the tool supplies control while agents run, and the audit supplies the evidence you hold afterwards.
September 2026: IBM put horizon scanning inside a governance tool
One dated case of a tool widening what it watches. On 16 September 2026 IBM announced a collaboration with CUBE, the London-based regulatory intelligence provider, adding a Regulatory Horizon Scanning capability inside IBM watsonx.governance. IBM describes the capability as continuously monitoring regulatory developments worldwide, capturing updates from regulators, legislative bodies, standards organizations and industry associations, and making them available inside governance workflows. IBM's announcement quotes CUBE founder and CEO Ben Richmond: "Regulatory intelligence is no longer a standalone discipline—it’s becoming a foundational layer of how AI itself is governed." Measured against the artifact test above, it is a governance tool watching more rules — not an audit. Horizon scanning monitors rules; it does not test your systems, evidence your controls, or give you an assurance opinion.
"We already have a governance tool" is not the same as being able to answer an audit
Owning tooling is not the same as AI agent governance maturity, and neither is the same as being able to answer the question an audit asks. IDC's Worldwide IAM Security Survey (May 2026, n = 860 identity and security decision makers, unweighted) found that only 18.5% of organizations run identity discovery continuously or in near real time, and only 27.3% have fully automated identity governance and access controls for AI agents. In the same research program, an IDC qualitative expert panel of 13 senior security and identity leaders was unanimous: every one of the 13 (13/13) flagged the inability to count the total number of agents operating in their environment. Read the two instruments separately — n = 860 is the survey behind the percentages; n = 13 is the panel, and 13 practitioners is a small qualitative sample, not a benchmark. The white paper is IDC Custom Solutions research sponsored by GuidePoint Security, which sells identity services (IDC #US54897326-WP).
"A single coding assistant session can spawn subagents, invoke skills and stand up local servers, each with its own credentials and lifespan measured in minutes. Do you count the product, the process, or the permission?" said Ax Sharma, security researcher at AI agent security vendor Manifold Security.
Frequently asked questions about AI governance tools and audits
What is the difference between an AI governance tool and an AI audit?
A tool controls agents and logs what it saw; an audit produces scope, approval and ownership records you hold.
Do you need both?
Most teams do. The tool constrains what agents may do now; the audit proves who answered for what they did.
Does an AI governance tool satisfy an auditor?
Not on its own. It proves what it observed inside its own console, not who had authority for an action.
What does horizon scanning not cover?
Your systems and your controls. It monitors rules; nothing IBM published claims testing, assurance or a conformity opinion.
Who owns the audit evidence, and how long must it last?
You do. Retention must outlast your incident-response cycle, sit outside the agent team's control, and stay readable 90 days later.
Sources.
WSO2 Agent Manager — InfoQ, “WSO2 Releases Agent Manager as Enterprises Look to Control Growing AI Agent Sprawl”, by Craig Risi (September 18, 2026) (infoq.com). General availability announced September 15, 2026, as reported by AI Stack Current (page dated September 16, 2026). The outlet’s own article slug is ws02-agent-manager, not wso2.
Opal Zero — Opal Security release, “Opal Security Launches Opal Zero to Make Least Privilege a Reality for Enterprise AI Agents” (dateline September 17, 2026) (opal.dev). Business Wire syndicated the release on September 18, 2026. Capability described as the release states it.
iProov HAPS — Biometric Update, “iProov’s experimental HAPS protocol aims to close governance gaps for AI agents”, by Joel R. McConvey (September 18, 2026, 12:36 pm EDT) (biometricupdate.com). The specification is published on GitHub under Apache-2.0 with a partial Rust reference implementation and test vectors; iProov reports no deployment, customer or standard-body status. The vendor’s own release was not retrievable at the time of writing, so Biometric Update is the cited source.
NetSuite audit-assurance gap — SiliconANGLE, “AI agents erase the paper trail, reshaping audit assurance”, by Jonathan Anthony (updated 16:22 EDT, September 17, 2026) (siliconangle.com). Sponsored-event coverage: theCUBE is a paid media partner for Workiva’s Amplify event. The finding is attributed to Josh Robinson, chief audit executive at Vast Space LLC, not to the outlet or the sponsor.
AI agent autonomy — TechTarget, “AI agent autonomy puts CIO controls to the test”, by Liz Hughes (published September 18, 2026) (techtarget.com).
16 governance tools — CIO.com, “16 governance tools for securing your AI fleet”, by Peter Wayner (Feature September 18, 2026) (cio.com). A vendor round-up; the tools are described as their vendors pitch them, so no single product description in it is treated here as a verified capability.
Info-Tech Research Group — PR Newswire, “AI Agents Are Influencing Product Decisions Without Explicit Human Authorization, Warns Info-Tech Research Group” (September 18, 2026) (prnewswire.com). Cited as the trigger for the checklist’s silent-delegation section; no figure from it is used in this note.
Regulatory Horizon Scanning — IBM New, "Accelerate AI compliance with Regulatory Horizon Scanning" (published September 16, 2026) (ibm.com).
CUBE and IBM — FinTech Global, "CUBE and IBM target AI regulatory blind spot", by Molly Snaylam (September 16, 2026) (fintech.global). CUBE here is the London-based regulatory intelligence provider, not theCUBE, the SiliconANGLE media partner cited above.
IDC white paper — “Managing Agentic AI Through the Identity Control Plane: What Organizations Should Look For”, IDC Custom Solutions, September 2026, #US54897326-WP, 54 pp. (analyst Grace Trinidad, Research Director, AI Security and Trust, IDC) (guidepointsecurity.com). The paper is IDC Custom Solutions research sponsored by GuidePoint Security, a consultancy that sells identity services. Every percentage above is from IDC’s Worldwide IAM Security Survey, May 2026 (n = 860 identity and security decision makers, unweighted) — a separate instrument from the 13-person qualitative panel, which sources only the “every respondent” finding. IDC’s public catalogue entry for US54897326 returns 404, so the sponsor-hosted PDF is the cited copy.
Ax Sharma and Mike Toole quotes — BankInfoSecurity, “Enterprises Can’t Count Their AI Agents, Survey Finds”, by Tiffany Wang (September 18, 2026) (bankinfosecurity.com). Both are interviews with the named practitioners, not findings of the IDC research; neither name appears in the IDC white paper.