Agentic AI access control must shift from sessions to actions

At a glance

What this is: This analysis says agentic AI requires action-level authorization, not just session-level access assignment, because agents choose tool sequences and execution timing at runtime.

Why it matters: IAM, PAM, and NHI teams need to revisit how delegated authority is bounded when an AI agent can act independently within a session and outpace static review models.

Context

Agentic AI changes the identity problem because the actor is not just authenticating and then executing a fixed path. The governing question becomes whether each tool call, API request, or data movement is consistent with the delegated objective and the current risk context.

That breaks the old IAM assumption that a session can be authorized once and then trusted until logout. For agentic workflows, the control boundary has to move to the action itself, with identity, capability, intent, and context all contributing to the decision.

Key questions

Q: What breaks when organizations rely on standard session-based access for AI agents?

A: Standard session-based access fails when the agent can make multiple decisions within a single session and the organisation cannot show which actions were authorised. The result is weak auditability, unclear accountability, and a higher chance that fraud or misuse will be hard to dispute or contain.

Q: Why do autonomous coding agents need intent-based authorisation?

A: Autonomous coding agents can optimise for task completion in ways that are locally rational but globally destructive. Intent-based authorisation forces the system to compare what the agent says it is trying to do with the privilege being requested before execution starts. That stops the agent from translating minor friction into a high-impact command.

Q: How do security teams know if agent authorization is actually working?

A: Authorization is working only if the agent can complete the intended task without gaining unnecessary reach. Good signals include short-lived credentials, task-scoped permissions, approval for sensitive changes, and clear logs linking each action to a user and an agent. If credentials are reused, privileges persist, or the agent can move between systems without reauthorization, the control is failing.

Q: What should organisations do when agent actions need human review?

A: Organisations should define escalation thresholds for actions that are ambiguous, high impact, or poorly explained by context, then route them to the right approver before execution proceeds. The key is to defer safely rather than force a binary decision under uncertainty.

Technical breakdown

Why session-based authorization fails for agentic workflows

Traditional IAM assumes that a subject can be given a role or token and then trusted to execute predictable requests inside that session. Agentic systems do not behave that way. They can choose tools, reorder steps, and alter their plan at runtime, which means the same session can produce different actions with different risk. That makes a static allow decision too coarse for autonomous behaviour. The control problem is no longer just who authenticated, but whether the next action still fits the task boundary and policy boundary. This is why action-level policy evaluation matters more than the login event.

Practical implication: Treat session start as only the beginning of authorization and move enforcement to every meaningful action.

How identity, capability, and intent combine in IBAC

The article’s IBAC model is built around three separate signals. Identity establishes who or what is acting. Capability describes what the agent can technically do. Intent or business objective defines why the action is being taken. Those three are not interchangeable. An agent may be capable of reading customer records or invoking infrastructure APIs, but capability alone does not justify use in a given context. In practice, policy engines need to compare the requested action against the delegated objective and the runtime context before the action reaches the backend system. That is a sharper control than static entitlements can provide.

Practical implication: Separate what an agent can do from what it is allowed to do under the current objective.

What runtime policy enforcement changes at the transaction layer

The technical shift is from network or gateway enforcement to semantic and transaction-layer enforcement. Instead of trusting a token at the perimeter, the policy layer evaluates the tool payload, arguments, and action context before downstream systems are touched. That allows the platform to allow, deny, constrain, redact, or escalate based on policy. It also means the control surface is now closer to the decision engine than the transport layer. For agentic AI, this is important because the risky event is not only access to a resource, but the specific action the agent chooses to take with that access.

Practical implication: Enforce policy on tool calls and arguments, not only on tokens and endpoints.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Action authorization is now the primary control boundary for autonomous systems: Session-level IAM is structurally too blunt when the actor can choose tools, sequencing, and timing at runtime. That means the security question shifts from granting access upfront to judging each action as it occurs. The implication is that identity governance for autonomous systems must be built around runtime decisions, not static entitlements.

Least privilege is no longer definable at provisioning time for autonomous actors: The article shows why capability, delegated authority, and intent have to be evaluated together. An agent can hold the technical ability to act without having the business justification to do so, which makes pre-provisioned permission sets an incomplete control model. Practitioners need to treat authority as task-scoped and context-bound, not as a persistent role.

Intent is becoming a governance signal, not just an LLM prompt technique: The central innovation here is not better prompting, but the use of intent as part of the authorization decision. That is a significant shift for identity programmes because it collapses the gap between business objective and policy enforcement. The practical conclusion is that agent governance must inspect why an action is happening, not only who is requesting it.

Human-in-the-loop must be policy-triggered, not uncertainty-triggered: The article correctly separates operational escalation from model confidence. That distinction matters because autonomous systems can be highly confident while still moving outside delegated scope. Policy thresholds tied to transaction type, data class, or cross-domain movement are more defensible than ad hoc manual review. The implication is that approval logic belongs in the control plane, not in operator judgement alone.

Identity continuity is becoming a runtime condition rather than a provisioning fact: In agentic workflows, the real issue is whether the same delegated purpose still holds across a chain of actions. That means identity assurance, capability constraint, and policy context need to persist through the workflow, not just at initial authentication. Practitioners should read this as a warning that continuous verification is now part of authorization design, not an optional add-on.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Identity continuity is no longer a session property: Agentic workflows force practitioners to think of identity as something that must survive and remain valid across a chain of decisions, not just at sign-in. That shifts control design toward per-action policy checks and away from assumptions that one authenticated session can safely cover an entire task.

Runtime policy is the decisive boundary for agentic AI because the threat is not only misuse of a valid session but out-of-scope action selection inside that session. Organisations that keep authorizing sessions instead of actions will miss the moment when an agent crosses from helpful automation into unsanctioned behaviour.

Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey. That gap suggests most programmes still need to redesign policy, telemetry, and review for runtime decisions rather than static access grants.

For practitioners

• Define action-level authorization boundaries Map which agent actions require per-call policy evaluation instead of session-level approval, especially tool use, API calls, database reads, and code execution.
• Separate capability from authority Document the skills an agent can execute and the permissions it is actually allowed to use in the current task, then prevent those two from being treated as equivalent.
• Make intent a policy input Require the policy engine to inspect the business objective and action payload before allowing sensitive operations, including cross-domain data movement and high-impact transactions.
• Push human review into explicit risk thresholds Trigger human-in-the-loop review only for defined policy conditions such as value thresholds, sensitive data exposure, or scope changes that exceed the delegated objective.
• Rework zero standing privilege for agents Grant access for the task window only, then revoke it immediately after the action completes so the agent does not retain ambient permissions across the workflow.

Key takeaways

• Agentic AI changes the authorization problem from provisioning access to judging actions as they occur.
• Static sessions are too coarse for agents that can change tool use, sequencing, and scope at runtime.
• The practical control shift is toward policy decisions based on identity, capability, intent, and context.

Key terms

• Request-level Authorization: Request-level authorization means access is decided for each request rather than once at login or network entry. It lets operators scope permissions by route, method, and identity, which is far more precise than broad network access and better suited to distributed systems and NHIs.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Intent-Based Access Control: An access control model that evaluates not just what an agent is requesting, but the inferred intent and context behind the request, granting or denying access based on whether the action aligns with the agent's declared purpose.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.