AI agents create risk because they can be provisioned quickly, used widely, and forgotten just as quickly. When they sit outside standard IAM review cycles, no one consistently validates ownership, permissions, or business need. That leads to persistent broad access, weak accountability, and hidden trust relationships that security teams may not discover until an incident or audit exposes them.
Why This Matters for Security Teams
Identity review cycles are designed for relatively stable human access, but AI agents behave more like running workloads than employees. They can be created for a task, chained into other tools, and forgotten when the work ends. That makes periodic access review a weak control if it is the only control. The real risk is not just excess privilege, but invisible trust paths that survive long after the original business need has changed. NHI governance guidance from NHI Management Group shows why this category needs continuous oversight, not annual cleanup alone, and the broader issue is reflected in the 2024 ESG Report: Managing Non-Human Identities, which found that 72% of organisations have experienced or suspect a breach of non-human identities.
AI agents also create a special failure mode because their access patterns are not fixed in advance. A static role may look reasonable at provisioning time and still become excessive once the agent starts calling more tools, handling more data, or acting on new prompts. Current guidance from the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10 both point toward runtime risk management rather than occasional review. In practice, many security teams encounter agent sprawl only after an incident or audit has already exposed the missing owner, the overbroad token, or the forgotten integration.
How It Works in Practice
The practical answer is to treat agents as dynamic workloads and review them as such. That means identity is tied to the workload, not to a long-lived human-style account. A common pattern is workload identity backed by short-lived tokens, with policy evaluated at request time instead of being frozen into a static role. This aligns with the direction of the NIST Cybersecurity Framework 2.0, which emphasises governance, access control, and continuous monitoring, and with agentic guidance from CSA MAESTRO agentic AI threat modeling framework.
For agents, the operational model usually includes:
- Just-in-time credential issuance for a specific task or session, followed by automatic revocation.
- Short TTL secrets rather than static credentials that survive multiple workflows.
- Runtime policy checks that consider the requested action, data sensitivity, tool chain, and current context.
- Explicit ownership and business justification for each agent, service account, or orchestration path.
- Continuous inventory reconciliation so dormant agents do not remain trusted by default.
This is where NHI discipline and agentic AI governance meet. The Ultimate Guide to NHIs is useful for the lifecycle side, while the Top 10 NHI Issues helps frame the most common control failures. These controls tend to break down when agents are allowed to self-chain across APIs and SaaS tools because no single team can reliably predict the full access path ahead of time.
Common Variations and Edge Cases
Tighter identity control often increases operational overhead, requiring organisations to balance faster agent delivery against stronger review discipline. That tradeoff is real, especially where agents are used for experimentation, internal copilots, or multi-step automation. Best practice is evolving, but there is no universal standard for how often every agent should be recertified. Most organisations need a tiered model based on privilege, data access, and external connectivity.
Edge cases matter. Some agents only read data, but read-only access can still be risky if the data is sensitive or if the agent can trigger downstream actions through another system. Others are embedded in CI/CD, customer support, or data pipelines, where ownership may sit across teams. In those environments, the control problem is less about one review cycle and more about proving who approved the agent, what it can reach, and whether its privileges still match the current use case. The 52 NHI Breaches Analysis shows how often hidden trust relationships become a post-incident discovery. For emerging agentic risks, the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework remain the clearest references.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Agentic systems need runtime authorization, not static review only. |
| CSA MAESTRO | 1.2 | MAESTRO addresses governance for autonomous agent workflows and tool use. |
| NIST AI RMF | GOVERN | AI RMF governance fits ownership, accountability, and lifecycle oversight. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Ephemeral credentials and rotation are central to reducing forgotten agent access. |
| NIST CSF 2.0 | PR.AC-1 | Identity management and access control map directly to agent review gaps. |
Replace fixed agent roles with request-time policy checks and short-lived permissions.
Related resources from NHI Mgmt Group
- Why do AI agents on Kubernetes create a different identity risk than normal workloads?
- When do API-based workflows create more access risk than they reduce in identity operations?
- Why do physical identity and access processes create risk when they remain siloed?
- Why do AI agents and other NHIs create more governance risk than traditional user identities?
