By Tehelka Web Desk
Nearly 84% of Indian organisations surveyed said an AI tool or agent accessed sensitive data beyond its intended scope in the past year, despite 99% having formal policies governing what data AI systems can access, according to Delinea’s 2026 Identity Security Report: The AI Enforcement Gap.
The report found that India is ahead of global levels on several measures of AI governance. Some 87% of Indian organisations said their AI data-access policies are actively enforced, compared with 71% globally.
However, Indian organisations also give AI systems access to substantially more sensitive information. Some 76% said AI tools can access employee data, compared with 51% globally, with similar gaps reported for customer data, financial records and source code.
“India’s enterprises have done the hard work on AI governance. Almost every organization has a policy, and most enforce it more rigorously than their global peers,” said Cynthia Lee, vice president, APJ, Delinea.
“But AI agents here also reach more customers, employees and financial data than the global average. At that point, a policy alone stops being enough,” she said.
The report also found a gap between confidence and accountability. While 98% of Indian organisations said they were confident they could demonstrate compliant AI access to a regulator, only 47% said they could always trace a sensitive AI access event back to the individual who approved it.
Nearly all respondents said credentials used by AI agents, including API tokens and MCP configuration files, are treated as privileged credentials. Yet 45% said some credentials remain active until the next audit, even after the task for which they were issued has ended.
Indian organisations detected their most recent AI scope violation in real time in 34% of cases, compared with 20% globally. Nearly half said they could immediately revoke both an AI tool’s credentials and an active agent session, compared with 35% globally.
However, only 43% said they could enforce AI access at the point of action in CI/CD pipelines, while India also trailed the global average in Kubernetes environments.
The findings come as Indian organisations prepare for obligations under the Digital Personal Data Protection framework.
“As DPDP obligations take effect, Indian enterprises will be asked to prove what actually happened: who authorized each access, what the agent did and why it was allowed,” Lee said.
