Periodic reviews fail when the agent can obtain and use access within a single task or session, leaving no stable state for later certification. In that case, governance has to move to issuance and runtime enforcement rather than relying on after-the-fact attestation.
Why periodic review breaks down for AI agents
Periodic review assumes there is a durable identity, permission set, or standing state to certify later. ai agents often do not behave that way: they can be created, delegated, and used within a short-lived session, then disappear before the next attestation cycle. That makes after-the-fact review too slow to prevent overreach.
When access is episodic, the control point shifts upstream. Governance has to focus on who can issue the agent, what it may do at the moment of use, and how long any access remains valid. A review process that only checks state after the task finishes will miss the real exposure window.
For this reason, periodic review is weaker than issuance control when the agent can act immediately after launch. The useful question is no longer “Is this still approved?” but “Was this allowed to exist with this authority in the first place, and was it constrained during execution?”
Why short-lived agent access defeats certification
The failure mode is a mismatch between the cadence of governance and the cadence of action. If an agent can obtain a token, complete a task, and release or replace that access before the next review, the certification record will always lag behind reality. The access may be gone, but the risk may already have been exercised.
This is especially visible when access is task-scoped, delegated, or continuously refreshed from another control plane. The review may show clean records while the actual control problem sits in the issuance path, the policy decision point, or the runtime boundary that granted the agent authority.
Practitioners should treat this as a lifecycle problem, not a reporting problem. A clean attestation does not prove the agent was safe during the session, only that it was easier to certify later than to constrain earlier.
What governance should move to instead
Governance should move from retrospective certification to real-time constraint. That means validating the requester, limiting the agent to task-appropriate authority, and binding access to the shortest useful duration. If the agent’s authority can change faster than the review cycle, the review is the wrong control point.
When the agent is able to act on behalf of a user or system, the safest design is to make each action decision explicit and bounded. AI Agent Authorisation Guide is useful here because it frames least privilege, just-in-time access, and per-action policy decisions as the control model, not after-the-fact approval.
That runtime view also connects to how the identity is managed across its lifecycle. Agentic AI Identity Guide helps explain why issuance, delegation, registration, and retirement matter more than periodic certification when the agent may only exist long enough to complete a single task.
Risk and Threat Considerations
Periodic review creates a false sense of control when the agent can borrow authority briefly and then shed it. That opens a window for excessive access, unauthorized side effects, and poor attribution, because the risky action happens before the next governance checkpoint.
Failure mechanism: The agent receives usable access during execution, completes the sensitive action inside one short-lived session, and exits before the next certification or recertification cycle can detect overprivilege or misuse.
Impact: Organisations may approve a control that looks sound on paper while still allowing harmful actions in production, which increases blast radius, weakens audit value, and delays containment when something goes wrong.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent review failure is driven by short-lived but excessive runtime authority. |
| Recommendation — Enforce per-action authorization and remove standing agent privilege. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Short-lived access hinges on credential issuance, validity, and revocation timing. |
| Recommendation — Set short-lived credentials and manage their lifecycle tightly. | ||
| NIST Zero Trust (SP 800-207) | AC-6 — Least Privilege | The issue is runtime authority exceeding what periodic review can safely certify. |
| Recommendation — Limit each agent to the minimum access required for the current task. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Periodic review fails when non-human identities can act with more privilege than needed between reviews. |
| NHI-07 — Long-Lived Secrets | Long-lived access material makes after-the-fact certification too slow for agentic sessions. | |
| Recommendation — Audit and reduce excess agent privilege before the next task executes. Replace durable secrets with short-lived credentials and rapid rotation. | ||
Practitioner Guidance
What to prioritise: Move review effort to issuance approval, runtime policy enforcement, and revocation speed before investing in more frequent certification cycles. If the agent can complete meaningful work in minutes, monthly or quarterly review will not be the primary safeguard.
What to verify: Confirm whether the agent’s access is time-bound, task-bound, and attributable at the moment of use, not just documented later. If you cannot reconstruct who authorised the action, what authority it had, and when that authority expired, the governance model is too weak for short-lived agent activity.
Common mistake: Treating a clean periodic review as evidence that the agent was properly controlled during execution. The better test is whether standing privilege is avoided and whether each task gets a fresh, bounded authorisation decision.
Practitioner takeaway: For AI agents, governance must follow the action window, not the audit calendar; if authority can exist and disappear within one task, certification is supplementary and runtime control is mandatory.
Related resources from NHI Mgmt Group
- How should organizations approach the governance of AI agents?
- Why do quarterly access reviews fail for AI agents and NHIs?
- Why do AI and data governance programs fail when they rely on periodic reviews instead of continuous controls?
- How should security teams run access reviews for non-human identities?