They should measure the share of traffic driven by agents, the journeys those agents concentrate on, and whether the same interactions are beneficial, unknown, or malicious. Those three signals show whether the organisation is dealing with a niche phenomenon or a material shift in customer access patterns. They also tell teams where policy tuning will matter most.
Why This Matters for Security Teams
Agent-driven traffic is not just another channel metric. It is a signal that autonomous software is making decisions, chaining tools, and interacting with your controls in ways that traditional customer identity programs were not built to interpret. That is why teams should measure how much traffic is agent-originated, which journeys it concentrates on, and whether those interactions are helpful, ambiguous, or abusive. The concern is not volume alone, but behavioural shift and control impact.
This matters because agentic systems can look legitimate at the edge while behaving very differently once inside the flow. Current guidance from the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10 points to runtime context, intent, and continuous evaluation rather than static trust assumptions. NHIMG research on the Ultimate Guide to NHIs shows how often organisations still struggle to see and govern non-human access at all, which makes agent-driven traffic especially easy to miss in existing fraud dashboards. In practice, many security teams only discover agent concentration after a journey starts breaking policy or converting at an unusual rate, rather than through intentional measurement.
How It Works in Practice
IAM and fraud teams should treat agent-driven traffic as a measurement problem first and a policy problem second. The aim is to distinguish who or what is acting, what they are trying to do, and whether the action is aligned with approved automation. That means instrumenting identity signals, request patterns, and downstream outcomes together instead of relying on login events or bot scores in isolation. The question is not simply “human or bot,” but “what kind of agent, acting under what authority, for what purpose?”
A practical measurement stack usually includes three layers:
-
Source and identity: tag traffic that arrives with workload identity, delegated tokens, service accounts, or other machine-authenticated credentials. Workload identity approaches such as SPIFFE and short-lived OIDC tokens help prove what the agent is, not just what it borrowed.
-
Journey concentration: track which flows the agent uses most, such as sign-up, search, pricing checks, checkout, password reset, ticket creation, or API extraction. Concentration often reveals where automation is adding value or where abuse pressure is building.
-
Outcome classification: label the same interaction as beneficial, unknown, or malicious based on intent, rate, sequence, and post-action impact. This is where policy-as-code and runtime authorisation matter, because static allowlists age badly when agents adapt.
For agentic systems, static role-based IAM often fails because the workload does not have a fixed access pattern. The emerging model is intent-aware and context-aware authorisation, with just-in-time credential issuance and rapid revocation when a task completes. That approach is consistent with both the CSA MAESTRO agentic AI threat modeling framework and NHIMG coverage of agent risk in OWASP NHI Top 10. Teams also need to correlate the same agent across devices, sessions, and tool calls, because one autonomous workflow can start as low-risk browsing and end in credential abuse or lateral movement. These controls tend to break down when agents are embedded inside customer-facing workflows that reuse human session infrastructure, because identity boundaries and behavioural signals blur together.
Common Variations and Edge Cases
Tighter agent measurement often increases operational overhead, requiring organisations to balance richer classification against privacy, latency, and false-positive risk. That tradeoff is real, especially when fraud teams want fast decisioning and IAM teams want precise attribution. Best practice is evolving, but there is no universal standard yet for how aggressively to label agent traffic in mixed human-machine journeys.
One common edge case is authorised automation that still looks anomalous. For example, price comparison agents, support copilots, and internal workflow agents may concentrate on the same journey as fraud actors, but their intent and blast radius are different. Another is delegated human action, where an agent acts with a human’s token but its behaviour exceeds the user’s expected pattern. In those cases, teams should measure not only the session source but also the permission pathway, task scope, and whether the action was initiated under NIST AI Risk Management Framework governance. NHIMG reporting on the Ultimate Guide to NHIs highlights why short-lived credentials and rotation discipline matter when machines move faster than review cycles. The practical test is whether an organisation can explain why the agent was allowed to do that journey, not just whether it completed it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A01 | Agentic misuse and overreach are central when measuring autonomous traffic. |
| CSA MAESTRO | T2 | MAESTRO covers agent threat modeling and journey-level risk analysis. |
| NIST AI RMF | GOVERN | AI RMF governance supports accountable measurement of agent behaviour and outcomes. |
| OWASP Non-Human Identity Top 10 | NHI-03 | NHI credential lifecycle matters when agents use short-lived or delegated access. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access monitoring apply directly to agent-driven access paths. |
Review agent entitlements against least-privilege rules and alert on unexpected journey expansion.
