TL;DR: AI agent security is moving below ordinary software controls, with NVIDIA’s force field model and Open Agent Safety Platform highlighting deny-by-default access, reduced privileges and hardware-backed enforcement, according to Anjuna. The central issue is that least agency fails when the governance layer itself can be inspected or altered by software.
At a glance
What this is: This is Anjuna’s analysis of why agent security is shifting toward hardware-backed enforcement and why software-only containment is no longer enough.
Why it matters: It matters because identity teams now have to govern not just access granted to AI agents, but the trust boundary that decides, brokers and audits that access.
Context
AI agent security is the problem space here: how to constrain runtime access, tool use and credential handling when the actor can decide and act at machine speed. The article argues that software-defined guardrails are not sufficient if the control plane itself can be inspected or altered.
For IAM and NHI programmes, the shift is not just about narrower privileges. It is about where the policy decision lives, who can trust it, and whether the enforcement layer remains trustworthy when the surrounding environment or host is compromised.
Key questions
Q: How should security teams implement least agency for autonomous AI agents?
A: Security teams should limit each agent to the minimum autonomy, permissions, and standing needed for one task. Narrow the goals it can pursue, require human approval for high-risk tools or actions, and issue short-lived credentials whenever possible. Treat delegation as temporary, not persistent, and review whether an agent can affect systems, memory, or data outside its intended scope.
Q: Why do software-only guardrails fail for autonomous agents?
A: Because the guardrail itself sits inside the same software stack it is trying to control. If the host OS, runtime or policy engine can be inspected, altered or bypassed, then the agent’s containment is only as strong as that weakest layer. Hardware-backed isolation changes the trust assumption.
Q: What are the signs that an AI application has too much authority?
A: A common sign is that a single model response can write to databases, send messages, start workflows, or spend resources without a separate check. Another indicator is when the same identity can reach multiple systems even though the task only needs one narrow permission set.
Q: Should organisations treat AI agents as NHI or as application automation?
A: They should treat them as governed non-human identities with application behaviour. That framing captures the need for identity, scope, lifecycle, and audit controls while still recognising that agents operate through APIs, tools, and workflows. Pure automation language hides the governance gap.
Technical breakdown
Why software-defined containment breaks for autonomous agents
Software sandboxes, deny-by-default network policy and filesystem restrictions can narrow the blast radius of an agent, but they still depend on the surrounding runtime being trustworthy. When the agent can explore systems, chain actions and adapt tactics at machine speed, any parser, gateway or policy engine in software becomes part of the attack surface. The security question is no longer only whether an action is allowed. It is whether the control deciding that action can itself be trusted under compromise pressure.
Practical implication: Treat software containment as a control layer, not the trust boundary.
Why hardware-backed governance changes the identity model
The article’s core shift is from protecting the agent to protecting the governor. Confidential Computing can isolate policy logic, credential brokering and runtime state inside an attestable boundary so the agent, host OS or cloud administrator cannot simply inspect or modify them. That changes the identity model from software-enforced privilege to hardware-anchored authority. For NHI governance, this is the difference between limiting what an agent may do and limiting who can tamper with the decision that authorises it.
Practical implication: Move policy evaluation and credential release into an independently attestable boundary.
What least agency means for AI agent access
Least agency extends least privilege to autonomous behaviour. The agent should receive only the authority required for the current task, with brokered credentials, conditional tool access and context-aware decisions rather than permanent session rights. The key point is that access must be evaluated continuously because an agent’s intent, sequence and tool choice can change during execution. Static permission models that assume access is fixed at session start do not map cleanly to autonomous runtime behaviour.
Practical implication: Design AI agent access around task-scoped authority, not session-scoped assumptions.
Threat narrative
Attacker objective: The objective is to turn legitimate agent access into trust-boundary failure that exposes policy logic, credentials or higher-value runtime control.
- Entry occurs when an autonomous agent is given legitimate access to systems, tools or credentials as part of its task.
- Escalation occurs when the agent combines allowed capabilities, reaches neighbouring resources or turns bounded access into broader operational effect.
- Impact occurs when a control or policy layer is itself exposed, allowing the surrounding environment to influence, observe or alter governance decisions.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Least privilege is no longer sufficient when the actor can change its own execution path. Traditional IAM assumes access can be granted, observed and reviewed within a stable session. Autonomous agents can combine tools, change sequence and exploit surrounding weaknesses faster than review cycles can react. The implication is that governance has to move from static privilege assignment to runtime control over agent behaviour.
Protecting the agent is not enough if the policy engine remains soft. Anjuna’s framing exposes a deeper governance gap: the system that decides access becomes the real asset to protect. If the enforcement layer sits in ordinary software, then host compromise, admin access or runtime tampering can undermine the control even when the agent itself is constrained. Practitioner conclusion: the trust boundary must cover the governor, not just the governed.
Least agency is the right named concept for autonomous access governance. It captures a narrower and more actionable principle than least privilege for AI agents: grant only the authority required for the current task, broker credentials instead of handing them over, and reevaluate actions as context changes. This is more than a policy tweak. It reflects a shift from session-based trust to task-based trust, which is where agent governance is heading.
Hardware-backed attestation changes the accountability model for NHI controls. If the policy and enforcement layer can be independently verified, security teams gain a stronger basis for trusting that access decisions were made by the intended control, not by a compromised host. That matters for regulated environments, because it makes control assurance part of the architecture rather than a retrospective audit exercise. Practitioners should treat attestation as a governance signal, not just an infrastructure feature.
AI agent security is converging with NHI governance, not replacing it. The article’s strongest point is that autonomous software still depends on identities, credentials and access paths, but those elements now operate inside a more volatile decision loop. That means NHI controls remain foundational, while agentic behaviour forces them to become dynamic, contextual and harder to fake. Security programmes should plan for that convergence now.
From our research library:
- Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
- Read next: AI Agent Authorisation Guide
What this signals
Least agency is the governance gap this article sharpens. Access review models assume privilege is stable long enough to be certified, but autonomous agents can acquire, combine and discard authority inside a single task. That means the programme has to move its primary control point to issuance time and runtime policy evaluation, not retrospective review.
The next governance question is not whether an agent can be constrained, but whether the control enforcing that constraint can be trusted when the environment is compromised. Hardware-backed attestation makes that question operational, because it turns policy assurance into part of the architecture rather than a procedural claim.
For practitioners
- Define least agency for AI agents Map each agent task to the minimum authority, tool set and data scope needed at runtime, then revoke anything outside that envelope.
- Move policy decisions into an attestable boundary Isolate credential brokering, policy evaluation and enforcement logic so the host environment cannot silently alter the control outcome.
- Separate observation from enforcement Do not rely on a monitoring layer alone. Use a distinct trust boundary for the logic that approves or denies agent actions.
- Review agent access for session drift Check whether an agent can expand effective privilege during a single task by combining allowed actions that were never intended to be compounded.
Key takeaways
- Autonomous agents expose a gap in static IAM thinking because they can change behaviour and compound permissions during execution.
- The real control issue is not just limiting the agent, but protecting the policy engine that authorises the agent.
- Least agency better describes the runtime governance model needed for AI agents than traditional least privilege alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agent privilege boundaries and runtime control of autonomous access. |
| Recommendation — Apply ASI03 to constrain agent privilege and broker access at runtime. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | AI agents are non-human identities, and the article focuses on reducing excess authority. |
| NHI-04 — Insecure Authentication | The article stresses attested governance and safe credential brokering for AI agents. | |
| Recommendation — Review agent permissions against NHI-05 and remove standing access the task does not require. Use NHI-04 controls to broker credentials through an attested trust boundary. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The post is fundamentally about who governs autonomous actions and how that control is trusted. |
| Recommendation — Establish GOVERN processes for accountable AI access decisions and control assurance. | ||
| NIST Zero Trust (SP 800-207) | verify explicitly — Verify explicitly | The article’s trust model depends on continuous verification of agent actions and environment trust. |
| Recommendation — Apply verify-explicitly principles to each agent action and policy decision. | ||
Key terms
- Least Agency: The agentic equivalent of least privilege, the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
- Hardware-backed attestation: A trust check that uses device hardware or secure enclave capabilities to verify that the environment is intact. It is stronger than local artifact checks because it can provide evidence about system integrity even when software-based indicators are hidden or manipulated.
- Policy Engine: A policy engine evaluates identity, device, and transaction data against defined rules and then automates the access decision. It is the mechanism that turns zero trust from a concept into an operational control by allowing approval, blocking, quarantine, or revocation based on risk.
- Device Trust Boundary: The device trust boundary is the point where an endpoint is considered sufficiently verified to access systems, data, or services. It defines the security line between trusted and untrusted device states, based on posture, identity, integrity, and policy. In practice, it governs whether a device can authenticate, connect, or receive sensitive access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org