Indian organisations have near-universal formal policies governing artificial intelligence access, but a significant gap remains between governance and enforcement, according to a new report by identity security company Delinea.
The 2026 Identity Security Report: The AI Enforcement Gap found that 99% of Indian organisations surveyed have a formal policy governing what data AI tools and agents can access. However, 84% said an AI tool or agent had accessed sensitive data beyond its intended scope during the past year.
The findings indicate that while organisations have established AI governance frameworks, controlling access at the point when AI systems actually perform tasks remains a challenge.
India records higher AI governance enforcement
India’s AI governance maturity exceeds global levels on several measures, according to the report.
Around 87% of Indian organisations said their AI data access policies are actively enforced, compared with 71% globally. At the same time, AI tools in India have access to a wider range of sensitive information.
The report found that 76% of Indian organisations said AI tools can access employee data, compared with 51% globally. Similar gaps were reported for customer data, financial records and source code.
Delinea Vice President, APJ, Cynthia Lee said Indian enterprises have made significant progress on AI governance but need greater visibility and control over how AI systems use their access.
“India’s enterprises have done the hard work on AI governance. Almost every organization has a policy, and most enforce it more rigorously than their global peers,” said Lee. “But AI agents here also reach more customers, employees and financial data than the global average. At that point, a policy alone stops being enough.”
Confidence outpaces demonstrable control
The report found a gap between organisations’ confidence in their ability to demonstrate compliance and their ability to trace and control AI activity.
While 98% of respondents said they were confident they could demonstrate compliant AI access to a regulator, only 47% said they could always trace a sensitive AI access event back to the individual who authorised it.
The report also found that 99% of organisations treat AI agent credentials, including API tokens and MCP configuration files, as governed privileged credentials.
However, 45% said some of these credentials remain active until the next audit, even after the task for which they were issued has ended. Delinea said such standing access can create opportunities for AI agents to operate beyond their intended scope.
AI overreach detected faster in India
Indian organisations also reported faster detection and response to AI access violations than their global counterparts.
According to the report, 34% of Indian organisations detected their most recent AI scope violation while it was happening, compared with 20% globally.
Nearly half said they could immediately revoke both an AI tool’s credentials and an active agent session, compared with 35% globally.
However, enforcement remains weaker in some environments where AI-powered coding agents operate. Only 43% of Indian organisations said they can enforce AI access at the point of action in CI/CD pipelines.
Kubernetes was the only environment covered in the study where India trailed the global average.
Runtime authorisation seen as the next step
Delinea said organisations need to move beyond access controls applied primarily at login and instead authorise AI access at the point when an action is performed.
The company advocates continuous, runtime authorisation with least-privilege controls and session visibility across AI, human and machine identities. Such controls can provide security teams with records of who authorised an access, what an AI agent did and why the access was permitted.
Lee said the shift will become increasingly important as Indian enterprises face greater requirements around demonstrating how AI systems access and use sensitive information.
Survey covered 250 Indian IT and security leaders
The India findings are based on a Censuswide survey of 250 IT and security leaders at Indian organisations with at least 500 employees that are using or piloting AI. The survey was conducted between August 3 and August 14, 2026.
The India study forms part of a global survey covering 2,254 IT and security leaders and 2,250 non-IT employees across the UK, US, Germany, Australia, Singapore, UAE, France and India.