Because IAM reviews assume access is relatively stable and can be assessed after the fact, while agents can change which tools they use and how they combine permissions during execution. That means a clean entitlement record does not guarantee safe behaviour. Governance has to account for runtime decision-making, not only provisioning-time scope.
Why This Matters for Security Teams
Traditional IAM reviews are built around the assumption that access can be described as a stable set of entitlements. Agentic systems break that assumption because the risky part is not just what an identity can see, but what an autonomous agent can do with tools, prompts, memory, and chained actions at runtime. That is why guidance from OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework increasingly focuses on dynamic behavior, not only provisioning records.
NHIMG research points to the same operational reality: in the AI Agents: The New Attack Surface report, 80% of organisations reported AI agents performing actions beyond intended scope, including unauthorized system access, sensitive data sharing, and credential disclosure. That means an entitlement review can look clean while the workload is already behaving unsafely. In practice, many security teams discover the gap only after an agent has chained permissions in a production workflow, rather than through intentional review.
How It Works in Practice
Effective governance for agentic systems starts by treating the agent as a workload with ephemeral authority, not as a human user with a durable role. The core control shift is from static RBAC to runtime policy evaluation. Instead of asking, “What should this identity generally be allowed to do?”, teams must ask, “What is this agent trying to do right now, with this context, against this tool, with this data?” That is the direction suggested by CSA MAESTRO agentic AI threat modeling framework and the MITRE ATLAS adversarial AI threat matrix.
In operational terms, security teams usually combine three controls:
- Workload identity for the agent, so the system can prove what the agent is at execution time.
- Just-in-time, short-lived credentials that are issued per task and revoked automatically when the task ends.
- Policy-as-code enforcement at the moment of tool invocation, not only during account provisioning.
This is where static secrets become a liability. Long-lived API keys or shared tokens make it easy for a compromised agent, plugin, or orchestration layer to persist beyond the intended task boundary. By contrast, JIT credentials and tight TTLs limit the blast radius when an agent behaves unexpectedly. NHIMG coverage of the OWASP NHI Top 10 also underscores that agentic applications should be assessed as changing execution environments, not fixed access subjects.
These controls tend to break down when multiple agents share a tool chain and the orchestration layer can reuse tokens across parallel tasks, because attribution and revocation stop matching the actual execution path.
Common Variations and Edge Cases
Tighter runtime controls often increase operational overhead, requiring organisations to balance stronger containment against developer friction and workflow latency. There is no universal standard for this yet, especially where agents collaborate across SaaS tools, internal APIs, and human approval steps. Best practice is evolving, but the pattern is consistent: the more autonomy an agent has, the less useful a once-a-quarter IAM review becomes unless it is paired with continuous telemetry and policy enforcement.
One edge case is read-heavy agents that appear low risk but can still expose sensitive data through retrieval, summarization, or prompt injection. Another is delegated agent workflows where a primary agent spawns sub-agents with inherited context; a clean top-level entitlement review does not reveal the effective permissions created downstream. For that reason, security teams should align reviews to task classes, data sensitivity, and tool reach, not just account ownership. NHIMG’s reporting on the LLMjacking threat pattern shows why runtime abuse matters: exposed credentials can be weaponized very quickly once attackers find agent-facing secrets.
In practice, IAM reviews remain useful for inventory and ownership, but they are no longer sufficient evidence of safety when agents can adapt their behavior mid-session and expand their effective privilege through tool use.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Agentic systems create runtime abuse paths that static IAM reviews miss. |
| CSA MAESTRO | MT-3 | MAESTRO focuses on threat modeling autonomous workflows and their control points. |
| NIST AI RMF | GOVERN | AI RMF GOVERN addresses accountability for autonomous AI behavior and oversight. |
Assess agent tool use, chaining, and prompt-driven behavior at request time, not only at provisioning.
