Agentic AI governance gaps are widening as adoption accelerates

At a glance

What this is: 1Password’s analysis of Gartner’s agentic AI guidance says adoption is accelerating faster than the governance, security and credential controls needed to supervise AI agents safely.

Why it matters: IAM, PAM and NHI teams need to treat AI agents as governed identities, because access, oversight and revocation decisions must be designed before agent sprawl makes retrofitting impractical.

By the numbers:

• Only 17% of organisations have deployed AI agents so far, according to Gartner research cited by 1Password.
• 42% expect to deploy AI agents in the next 12 months, according to Gartner research cited by 1Password.
• Another 22% expect to deploy AI agents within the following year, according to Gartner research cited by 1Password.

Context

Agentic AI governance is becoming an identity problem as much as a model or workflow problem. The article argues that current access controls were designed for actors whose intent, timing and scope are known before execution begins, while AI agents can act across multiple tools and identity contexts during runtime.

1Password frames Gartner’s Hype Cycle for Agentic AI as evidence that the market is moving faster than the supporting infrastructure. That gap shows up in agent catalog growth, credential lifecycle decisions, auditability and the lack of clear human oversight points for irreversible actions.

The governance issue is not simply that AI agents are new. It is that semiautonomous deployments require pre-authorisation, bounded permissions and traceable delegation before the first meaningful incident makes the control gap visible.

Key questions

Q: What breaks when AI agents inherit access from users and service accounts?

A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern. Once an agent can chain tool calls across systems, the original approval no longer describes the full blast radius. Security teams need to treat inherited access as a live identity surface, not a one-time provisioning artifact.

Q: Why do AI agents create risk even when they stay within approved permissions?

A: AI agents can be authorised correctly and still produce harmful outcomes because permission is not the same as intent or behavioural appropriateness. If an attacker manipulates the session mid-flight, the agent may keep acting inside scope while exfiltrating data, taking destructive steps, or chaining actions that no human would have approved.

Q: What do security teams get wrong about governing AI agents?

A: They often treat agents like another automation layer instead of governed non-human actors with their own access paths. Once an agent can connect to tools and data at runtime, the programme needs attribution, scoped privileges, and lifecycle oversight. Otherwise, the agent becomes an unreviewed extension of the enterprise access model.

Q: How should organisations preserve accountability across orchestrator and subagent chains?

A: They should preserve one continuous approval chain from the human decision through the orchestrator and into each delegated step. That means recording who authorised the action, which credentials were used and which subagents inherited the work. Without that evidence, accountability fragments across identity contexts and the organisation loses a defensible audit trail.

Technical breakdown

Why agentic AI breaks static access assumptions

Agentic AI changes the identity problem because the actor can chain tasks, select tools and trigger actions across systems during runtime. Traditional IAM and access review processes assume a stable requester, a fixed purpose and a reviewable access window. In a semiautonomous model, the credential may exist only for a specific action sequence, then be reused across subagents or adjacent workflows. That makes intent, scope and duration harder to define at provisioning time. The central issue is not merely more automation, but a delegation chain whose operational shape can shift while the task is still in motion.

Practical implication: treat agent credentials as scoped execution rights, not as durable identities that can be reviewed after the fact.

Credential lifecycle and revocation for AI agents

The article places credential lifecycle at the center of agent governance because issuance, validity and revocation become control points for risk containment. For human users, access may persist long enough for review cycles, but agents can be retired, re-tasked or compromised faster than periodic certification can react. If the credential cannot be revoked the moment the agent is no longer trusted, the organization inherits unnecessary blast radius. In practice, the lifecycle must be tied to agent purpose, agent state and the human authority that approved the deployment. That is a different control model from standard workforce account governance.

Practical implication: design issuance and revocation so agent credentials expire or are revoked on task completion, retirement or compromise.

Human oversight and pre-authorization for irreversible actions

Gartner’s guidance, as cited in the article, highlights that some agent actions require human oversight before execution, especially where code deployment or production data changes are irreversible. This is a governance boundary, not a monitoring problem. Post-action review can explain what happened, but it cannot restore accountability when the action itself should never have been allowed to occur without approval. The key technical question is where the approval gate sits in the delegation chain and whether the system preserves the original human authorisation across orchestrator and subagent layers. Without that continuity, auditability fragments.

Practical implication: enforce pre-authorisation for high-impact agent actions and preserve the human approval chain across every delegated step.

Threat narrative

Attacker objective: The objective is to turn delegated agent access into unauthorised or untraceable action that bypasses meaningful human control.

1. Entry occurs when an agent receives broad permissions or inherited access to tools, repositories or production workflows without tight task boundaries.
2. Escalation follows when the agent reuses those credentials across subagents or adjacent actions, expanding scope beyond the original human intent.
3. Impact occurs when an irreversible action, such as code deployment or production data modification, executes without a preserved approval chain or effective oversight.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access review was designed for access that persists long enough to be reviewed. That assumption fails when agents can obtain, use and discard privileges within a single task flow, or pass them through subagents before any certification cycle begins. The implication is not merely that access reviews need modernization, but that review-based governance no longer describes the control boundary for agentic execution.

Agent credential lifecycle is now a governance primitive, not an administrative detail. When the article says credentials must be issued, scoped and revoked around the agent’s purpose, it is describing a shift from identity administration to runtime risk containment. The practitioner consequence is that revocation speed and purpose binding matter more than static account ownership in semiautonomous deployments.

Human oversight must be preserved at the decision point, not reconstructed after the action. Post-monitoring can report what an agent did, but it cannot substitute for the missing approval that should have gated an irreversible action. That is why the governance model has to track authorisation continuity across orchestrator and subagent layers, not just log events after execution.

Agentic AI creates an identity delegation chain that existing IAM models rarely record as a single sequence. Human approval, orchestrator credentials and subagent permissions are often split across contexts that do not preserve end-to-end accountability. This is the kind of governance fragmentation that turns auditability into an assumption rather than evidence, and practitioners should treat it as a design flaw in current deployment patterns.

Agentic AI governance is emerging as a control plane problem, not just a policy problem. Gartner’s estimate of rapid adoption against immature governance means the market is moving toward architectural controls for visibility, decision modelling and bounded execution. For identity teams, the practical conclusion is that agent governance must be built into access architecture before agent sprawl makes retrofitting operationally unrealistic.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Agent sprawl will become the first governance stress test for most programmes. Once multiple teams can create or delegate agents, the challenge is no longer whether a use case works, but whether identity and approval paths still produce a verifiable audit trail. The control question shifts from access review cadence to whether the organisation can describe who authorised what before an agent acted.

Agentic AI governance now sits between IAM, PAM and workflow design. The article’s own recommendations point toward pre-authorisation, purpose-bound credentials and preserved delegation evidence as the minimum set of controls. For practitioners, that means agent governance should be handled as part of the identity architecture, not as a separate AI project.

Governance decisions are moving downward into platform teams. According to the 2026 Infrastructure Identity Survey, 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite. That makes operating model clarity as important as technical control design, because the people building the agent path are increasingly the people deciding how it is governed.

For practitioners

• Define a minimum-permission profile for each agent Map each agent to the smallest permission set required for its specific task, then tie that scope to a documented business purpose and an explicit owner.
• Bind credentials to the agent lifecycle Set issuance, validity and revocation rules so credentials expire when the agent is retired, re-scoped or no longer trusted.
• Place approval gates before irreversible actions Require human authorisation before code deployment, production data changes or other non-reversible tasks, and prevent the agent from self-approving those steps.
• Preserve delegation evidence across agent layers Record the original human decision and keep it linked to orchestrator and subagent activity so audit teams can follow one approval chain end to end.
• Review agent sprawl before scaling Inventory where agents already exist across productivity, engineering and analytics workflows, then assess where shared access or no-code creation is expanding governance gaps.

Key takeaways

• Agentic AI turns identity governance into a runtime control problem because permissions can be consumed faster than traditional review cycles can observe them.
• The article frames credentials, approval gates and delegation continuity as the control points that matter most when semiautonomous agents are used at scale.
• Practitioners should move governance earlier in the lifecycle, before agent sprawl makes retrofitting permissions, audit trails and human oversight impractical.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
• Human-in-the-Loop Escalation: Human-in-the-loop escalation is a control pattern that requires a person to approve or intervene before a high-risk action is executed. For agentic AI, it is most relevant where actions are irreversible, because post-event review cannot replace a missing approval gate.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.