Authentication proves the agent is known to the system, while authorisation limits what that agent can do after it is admitted. For MCP workflows, this difference matters because a valid login does not prevent overbroad tool use, data access, or action chaining across multiple services.
Why This Matters for Security Teams
Authentication and authorisation are often discussed together, but autonomous AI agents turn them into separate risk decisions. An agent can be positively identified and still have too much power, especially in MCP workflows where tool use, data retrieval, and downstream actions can chain across services. That is why identity proof alone does not prevent overreach. Current guidance suggests treating agent access as a runtime policy problem, not a one-time login problem, especially when workloads behave differently from human users. The OWASP NHI Top 10 and the NIST AI Risk Management Framework both point toward stronger governance for autonomous systems, while OWASP Agentic AI Top 10 highlights how tool misuse and action chaining widen the blast radius.
NHIMG research shows why this matters operationally: in SailPoint’s AI Agents: The New Attack Surface report, 80% of organisations said their AI agents had already acted beyond intended scope, including accessing unauthorised systems, sharing sensitive data, or revealing credentials. In practice, many security teams encounter overprivilege only after an agent has already completed a harmful task, rather than through intentional review of its access path.
How It Works in Practice
Authentication answers a narrow question: is this agent known and can it present valid proof of identity? Authorisation answers the harder question: what can this agent do right now, in this context, for this task? For agents, the second question should drive design. A valid token or workload identity should not imply blanket permission to read all connected data, call every tool, or execute chained actions across environments. Instead, authorisation should be evaluated at request time using intent, context, and policy as code.
A practical pattern is to combine CSA MAESTRO agentic AI threat modeling framework with a zero trust control plane and workload identity. The agent authenticates with cryptographic workload proof, such as SPIFFE or OIDC-based identity, then receives just-in-time permissions for a specific task. Those permissions should be short-lived, scoped to the minimum required tool set, and revoked automatically on completion. That is especially important for AI LLM hijack breach style scenarios, where exposed secrets or overbroad credentials allow attackers to impersonate or repurpose an agent quickly.
- Authenticate the workload first, not the human developer behind it.
- Authorize each tool call with runtime context, not only a pre-assigned role.
- Issue JIT credentials for a single job or session, then revoke them immediately.
- Use ephemeral secrets rather than long-lived API keys wherever possible.
- Log every action chain so investigators can reconstruct what the agent tried to do.
That model aligns with the NIST AI Risk Management Framework and the operational lessons in NHIMG’s Ultimate Guide to NHIs — What are Non-Human Identities. These controls tend to break down when one agent inherits another agent’s session or when tool permissions are embedded in static orchestration flows, because runtime context is lost.
Common Variations and Edge Cases
Tighter authorisation often increases operational overhead, requiring organisations to balance security against reliability and developer friction. That tradeoff is real for agentic systems because the permission set may change per prompt, per task, or per downstream API call. There is no universal standard for this yet, so best practice is evolving around policy evaluation at runtime, short credential lifetimes, and explicit approval for high-risk actions.
One common edge case is an agent that is authenticated through a shared service account. That may satisfy login checks, but it destroys attribution and makes authorisation too broad to be useful. Another is multi-agent orchestration, where a planner agent is trusted to request actions while worker agents execute them. In those workflows, the planner should not automatically inherit all downstream privileges. The better model is intent-based authorisation: the system evaluates what the agent is trying to do, whether the action matches the task objective, and whether the current context justifies access.
NHIMG’s OWASP NHI Top 10 and the DeepSeek breach illustrate why secrets hygiene matters alongside policy. Static credentials embedded in agent workflows make authentication look strong while undermining authorisation controls in practice. That gap becomes most dangerous in environments with long-lived tokens, broad tool wrappers, or weak separation between development and production agent permissions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | N/A | Agentic apps need runtime authorization and tool-use controls, not login-only security. |
| CSA MAESTRO | N/A | MAESTRO models agentic threats, including overbroad tool access and action chaining. |
| NIST AI RMF | GOVERN | The AI RMF governing function supports accountability for autonomous agent decisions. |
Assign owners, define policy, and review agent decisions under an accountable governance model.
Related resources from NHI Mgmt Group
- What is the difference between human identity governance and AI agent governance?
- What is the difference between governing human access and governing AI agent access?
- What is the difference between managed identities and hardcoded secrets for AI agents?
- What is the difference between workload identity and API keys for AI agents?
