New research reveals a gap between AI policy and enforcement, and pressure on employees to use AI on sensitive data

SAN FRANCISCO, Sept. 29, 2026 (GLOBE NEWSWIRE) -- Delinea, the identity security platform that continuously controls what AI agents, humans and machines can do and for how long, today published new research examining where AI governance breaks down in practice. According to the report, 2026 Identity Security Report: The AI Enforcement Gap, 87% of IT leaders say an AI tool or agent accessed sensitive data beyond its intended scope in the past year. The report also found that fewer than one in five can detect a scope violation as it happens.

The findings draw on two global surveys of 2,254 IT and security leaders and 2,250 non-IT employees at organizations of 500 or more employees that use AI, across the UK, US, Germany, Australia, Singapore, UAE, France and India. Together, they show that near-universal policy adoption has done little to change how employees handle AI in practice. Employees are already routing around it: 76% say they have bypassed the required approval process for using AI at some point.

“Written policy is only as good as your ability to enforce it at the moment an AI agent acts,” said Art Gilliland, CEO of Delinea. “Our research echoes what I hear from leaders constantly: they have the AI policies in place, but they can’t see or report on what their agents actually do.”

Key findings from the report include:

Policy adoption has outpaced enforcement: 99.7% of organizations now have a formal policy governing what data AI tools and agents can access, yet only about half check that access against policy in real time.
Employees feel pushed past the guardrails: 60% say they have felt pressured to use AI on sensitive or confidential data even when they were unsure it was permitted. When deadlines outpace the governance process, many look for a faster route instead of following it.
Accountability is thin: just 36% of IT leaders can always trace a sensitive AI access event back to a named human authorizer, even though nearly all organizations require named-individual approval for at least some sensitive use. The gap lies in execution rather than in the rules.

The gap is widest where developers offload the most work to coding agents

Across six major environments, 47% of organizations lack enforcement at the moment of action in at least two. The weakest are CI/CD pipelines and Kubernetes, and even the strongest, cloud data stores, leaves gaps. When an agent steps outside its scope, detection lags: 55% of organizations take a full day or longer to catch it.

Closing the gap between policy and enforcement calls for authorizing AI access at the moment of action, not only at login. Delinea applies continuous, runtime authorization with least-privilege scoping and full session visibility across AI, human and machine identities, giving security teams a defensible record of who authorized each access, what the agent did and why it was allowed.

To read the full findings, download the report here: https://delinea.com/resources/ai-policy-enforcement-report

About Delinea
Delinea is an identity security platform governing what AI agents, humans and machines can do, and for how long. Just-in-time authorization extends privileged access management from access to action, cutting standing privilege across on-premise, multi-cloud and ephemeral infrastructure. Its platform scores identity risk and keeps access decisions auditable. Over 9,000 organizations, including two-thirds of the Fortune 100, rely on Delinea. Learn more at delinea.com.

Media Contact
Justin Ordman
Corporate Communications Director
PR@delinea.com

This item of content is a press release from a third party provider who make no warranties or representations in connection with this content and therefore PA can make no warranties in respect of its use.

Tags

More Like This

Delinea Report Reveals Only 44% of Organizations Are Fully Equipped to Support Secure AI

Delinea Report Finds 90% of Organizations Pressure Security Teams to Loosen Identity Controls for AI

Delinea Delivers Runtime Authorization for AI Agents, the Only Platform to Enforce Policy on Actions Before They Execute

AI-driven Attacks to Become Faster, More Sophisticated, and Harder to Detect by 2026, New Delinea Report Shows

Delinea Unveils Enterprise-Grade Cloud-Native Security Capabilities to Help Safeguard and Scale AI Innovation

69% of Organizations Breached by Ransomware Over Past Year, Delinea Report Finds

Delinea Unveils Delinea Iris AI to Make Identity Security Simpler, Stronger, and Smarter

Delinea Report Finds Identity Security Controls Now Central to Cyber Insurance Coverage Decisions