Agentic AI delegation needs continuous zero trust across workflows

At a glance

What this is: NHI Mgmt Group's analysis, drawing on IndyKite's blog post: Agentic AI pushes zero trust from point-in-time approval to continuous workflow control across delegation chains, tools and data sources.

Why it matters: IAM and security teams need to govern each agent handoff, because runtime context and delegated authority can change faster than conventional access decisions can keep up.

Context

Zero trust assumes every request is evaluated in context, but agentic AI breaks the old assumption that one identity makes one request and then stops. A single task can now fan out across models, tools, data sources and delegated sub-actions, so identity governance has to follow the workflow rather than the entry point.

The governance gap is not just visibility at login. It is the loss of stable decision boundaries while a system is still acting, which makes zero trust for AI agents a useful way to frame continuous verification, delegated authority and runtime enforcement.

Key questions

Q: How do agentic AI controls differ from traditional Zero Trust practices?

A: Traditional Zero Trust often stops at verifying identity and device posture, but agentic controls must verify what the actor does after access is granted. In practice, that means applying continuous scrutiny to tool calls, data movement, and delegated actions. The key difference is that the security boundary moves from login to runtime behaviour.

Q: Why do delegated agent actions create accountability problems?

A: Delegated agent actions can hide which model chose the path, which policy allowed it, and which tool executed it. Once the human credential is used as a shortcut, the audit trail becomes ambiguous and responsibility is blurred. Preserving the delegation chain at every hop is what keeps accountability usable.

Q: Why does runtime intent matter for agent authorisation?

A: Runtime intent matters because agents can pivot, chain tools, and continue acting after the original request has shifted in scope. If the policy engine only checks identity and attributes once, it misses whether the current hop still fits the approved purpose. Continuous intent checks reduce the chance that valid access becomes out-of-scope action.

Q: What should teams log when AI agents perform sensitive actions?

A: Log the delegator, the delegate, the declared purpose, the scope of resources, the expiration bound, and the policy decision rationale. Those fields let security and compliance teams answer who authorised the action, why it was allowed, and whether the workflow stayed within consented intent.

Technical breakdown

Why point-in-time authorization fails in agentic workflows

Agentic workflows do not behave like conventional application calls. One request can trigger a chain of model calls, tool invocations, delegation to other agents and data access decisions before the original task completes. If authorization happens only at the start, later actions can drift outside the conditions that made the first decision acceptable. The problem is not just more steps. It is that the security state changes while the task is still running, so the authorization system must remain aligned to the live transaction. Read AI Agents vs Agentic AI.

Practical implication: Treat each agent workflow as a sequence of governed decisions, not a one-time approval.

Delegation chains create nested authority that must stay attributable

Delegation is central to agentic systems because users delegate to agents and agents may delegate further to other agents or tools. That creates a nested authority chain in which every handoff can change who is acting, on whose behalf, and under which policy. Accountability depends on preserving both the current executor and the original requester across the chain. Without that linkage, policy enforcement may still occur, but attribution and review become much weaker. See the Agentic AI Identity Guide.

Practical implication: Bind every delegated action to both the active agent and the initiating principal.

Runtime context becomes part of the authorization decision

Context is not just metadata in agentic systems. It becomes operational memory that influences whether a later action should still be allowed. Data sensitivity, prior actions, provenance, environmental state and business policy can all change during execution, so the same action may be valid in one moment and unsafe in the next. Static rules cannot express that shifting state well enough on their own, which is why runtime enforcement is the control pattern that matters most here. See the Agentic AI Security Guide.

Practical implication: Evaluate agent actions against current context, not only against the permissions present at session start.

NHI Mgmt Group analysis

Zero trust for agentic AI is a control model for action chains, not just identities: once a system can retrieve, decide, call tools and hand work to other agents, the security problem shifts from who logged in to which actions remain valid at each step. That makes continuous policy evaluation the real governance boundary. Practitioners should measure control coverage across the whole workflow, not just the first request.

Delegated authority is the new unit of risk in autonomous workflows: when agents can act for users and then delegate again, the critical question becomes whether each handoff preserves intent, scope and attribution. The article's core point is that accountability must survive across multiple executors, not just through one session. That means governance must inspect delegation depth, not simply access scope.

Runtime enforcement is the only practical response to moving context: agentic systems can create, consume and act on context in the same transaction, so the authorization state is no longer fixed long enough for a traditional review cycle to matter. The implication is a shift from static approval to continuous decisioning at the moment of action. Security teams should treat this as a structural change in how policy is applied.

Contextual authorization becomes the deciding control surface for agent identity: business rules, data sensitivity and prior workflow steps now influence whether an action is safe, which means least privilege is no longer something you can define once at provisioning time. The named concept here is a runtime governance gap: the distance between a permitted identity and a permitted action grows as the workflow unfolds. Practitioners should close that gap by governing the transaction, not the account.

From our research library:

• The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
• Read next: Agentic AI Identity Guide

What this signals

Runtime governance gap: agentic systems create a growing distance between the authority granted at the start of a task and the authority needed by the time the task reaches later tools or sub-agents. Governance programmes should assume that a permission granted once can become stale before the workflow ends.

As agent delegation becomes more common, control design needs to move toward decisioning that follows the transaction rather than the user session. That shift affects zero trust architecture, IAM review models and any programme that still assumes access can be certified after the fact.

67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey. Agentic workflows make static authority harder to defend because the relevant decision point keeps moving.

For practitioners

• Map every agent handoff Inventory where users delegate to agents and where agents delegate further to tools or other agents, then require a policy check at each transfer of authority.
• Enforce runtime authorization Move control decisions from session start to action time so each tool call is judged against the current context, not the initial login state.
• Preserve action attribution Record both the active executor and the original requester for every meaningful agent action so reviewers can trace delegated work end to end.
• Treat context as a security input Include data sensitivity, provenance, prior workflow steps and environmental conditions in the decision logic for agent actions instead of relying on static permissions.

Key takeaways

• Agentic AI changes the security unit of analysis from a login to a live workflow with multiple delegated actions.
• The hardest governance problem is preserving attribution and policy alignment as authority moves across agents, tools and data sources.
• Controls that only evaluate access at session start cannot reliably govern systems that continue making decisions after the initial request.

Related NHI Mgmt Group resources: Zero Trust for AI Agents · Agentic AI Identity Guide · Agentic AI Security Guide · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Delegated authority: Delegated authority is permission given to one identity to act on behalf of another within defined limits. In identity systems, it enables an agent, user, or service account to perform approved actions without owning the underlying rights, using scoped tokens, roles, or approvals to constrain access and accountability.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity programme, it is worth exploring.