Agentic AI governance is lagging deployment velocity in enterprises

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Strata Identity's blog post: The widening gap between AI agent deployment and governance maturity means runtime behaviour is outpacing static IAM and review-based controls.

Why it matters: IAM, IGA, and PAM teams need to treat agentic AI as a live identity governance problem because access is being exercised dynamically, not just assigned on paper.

By the numbers:

• 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from less than 5% in 2025.

Context

Agentic AI governance is the set of controls that determines what AI agents can access, what they can do, and how their actions are traced back to an accountable human or system. The problem in this article is that enterprises are deploying agents into production faster than they are building those controls, leaving policy, audit, and delegation models behind runtime behaviour.

The article frames the risk in identity terms rather than general AI terms. Agents are operating across customer data, internal APIs, MCP, and cloud environments, which means the failure is not only model behaviour but also how identity, authorisation, and observability are enforced when a non-human actor acts at machine speed.

Key questions

Q: Why do static IAM controls break down for AI agent execution?

A: Static IAM assumes privileges can be defined and reviewed in advance, but AI agents make decisions at runtime and can change their execution path during the session. That means a valid login can become broad standing trust for later actions. The control model has to move from entitlement grant to continuous authorization at the point of action.

Q: Why do AI coding agents create access and governance risk even when they are not autonomous?

A: Because they already operate with tool access, repository access, and execution permissions inside a live workflow. That means the risk comes from delegated authority, not just independence. Even partially supervised agents can still manipulate sensitive code, secrets, or deployment paths if their permissions and review boundaries are loose.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.

Q: What should organisations do when an AI agent delegates work to other agents?

A: Organisations should require a traceable delegation chain that records the initiating identity, each handoff, each tool call, and the business purpose of downstream access. Without that chain, teams cannot determine whether the final action still matched the original authorization or whether privilege expanded silently as the workflow progressed.

Technical breakdown

Why static IAM breaks for agentic AI

Static IAM assumes an identity has durable scope, predictable behaviour, and access that can be reviewed after the fact. Agentic AI breaks those assumptions because an agent can request, combine, and release permissions inside a single task while changing paths based on runtime context. That means role assignment alone does not tell you what the agent will actually do, and access review evidence may be obsolete before the next review cycle begins. In agentic systems, the important control point is not just entitlement state but the decision made at the moment of action.

Practical implication: move governance from periodic entitlement checks to runtime authorisation decisions.

How MCP becomes a governance boundary

Model Context Protocol is the access layer that connects agents to tools and data sources, so it becomes a natural enforcement boundary. Without policy at that boundary, agents can bypass the intended path and reach backend systems through alternate connectors, direct API calls, or ad hoc integrations. In other words, MCP is not just an integration protocol, it is part of the identity trust chain. If requests are not authenticated, authorised, and logged at MCP entry, the organisation loses control over who or what is invoking the tool.

Practical implication: treat MCP as a first-class control point, not a convenience layer for tool access.

What broken delegation chains look like in practice

Delegation in agentic environments should preserve the original human authority through each hop. The article highlights a common failure mode where each downstream agent receives fresh credentials or new permissions, severing traceability from the initiating user. That turns delegated action into a new authority event rather than a continuation of the original one. Once the chain is broken, you cannot reliably answer who approved the action, which scope was intended, or whether the downstream step remained inside policy.

Practical implication: preserve end-to-end delegation traceability across every agent hop.

Threat narrative

Attacker objective: The objective is to use agentic access paths to reach data and systems that should have remained constrained to a narrower, auditable task scope.

1. Entry occurs when an agent is granted broad or reused access to customer data, APIs, or tool chains without runtime governance.
2. Escalation happens when privilege drift, reused service accounts, or ad hoc connectors expand what the agent can reach beyond the original task.
3. Impact follows when the agent acts across cloud environments or backend systems with little oversight, creating exposure that is hard to trace back to the initiating user.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI governance fails when organisations keep using static identity assumptions for dynamic actors. Access reviews, role assignment, and semi-annual certification were built for identities whose effective privilege changes slowly. Agents execute thousands of actions per minute and can change tool use mid-session, so the governance model itself is out of date before the control completes. The implication is that identity governance must be evaluated at the moment of execution, not only at provisioning time.

Runtime authorisation is now the decisive control plane for agentic AI. The article shows that identity is the most effective chokepoint because every agent action begins with an authentication or authorisation event. That shifts the governance problem from monitoring model outputs to controlling action issuance, scope, and traceability. Practitioners should treat runtime identity orchestration as the control that determines whether agentic AI stays governable at all.

Privilege drift is the named concept that best explains the enterprise risk here. In human IAM, privilege creep is usually gradual and visible; in agentic environments, over-permissioning can happen in bursts as teams widen OAuth scopes, reuse service accounts, or add connectors to prevent workflow breakage. The result is not just excess access, but excess access that grows faster than the governance process can observe. The implication is that agentic AI turns entitlement sprawl into an operational risk, not a periodic audit finding.

Broken delegation chains expose a governance assumption that did not fail in human IAM until now. The assumption was that delegated authority remains traceable through the workflow. That assumption fails when one agent hands work to another and new credentials are minted at each hop, because downstream actions no longer inherit the original human context. The implication is that identity governance must preserve authority lineage, not just authenticate each node independently.

MCP will become a governance fault line unless it is treated as part of identity architecture. The article is right to place MCP alongside APIs and cloud access, because agents will use whichever path reaches the data fastest if the sanctioned route is weak. That means the control problem is not only protocol security, but whether the protocol sits inside policy, logging, and enforcement. Practitioners should align MCP controls with the same governance discipline used for high-risk API access.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Agentic AI governance will increasingly be judged by runtime control quality, not by policy volume. Enterprise programmes that rely on quarterly reviews will continue to lag because agent decisions happen inside the execution window, not after it. The practical shift is toward issuance-time controls, traceable delegation, and policy enforcement at the access boundary.

Privilege drift is the operating concept teams should now watch most closely. When agents are allowed to accumulate scopes, reuse service accounts, or switch tools under pressure, the security problem is no longer a single misconfiguration but a compounding trust debt. That makes entitlement review a signal, not a solution.

Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security. according to the 2026 Infrastructure Identity Survey. That gap shows governance is still trailing deployment, which means most teams are accepting agentic risk before they have defined control boundaries.

For practitioners

• Define runtime authorisation for agents Require every agent action to be evaluated at the moment of execution using initiator, task scope, resource need, and delegation context, rather than relying on static roles.
• Issue ephemeral identities for every agent task Replace shared service accounts, hardcoded API keys, and reused credentials with task-scoped identities that expire when the task ends.
• Enforce MCP gateway controls Route every MCP request through an enforcement point that validates identity, checks policy, and records the access decision before backend execution.
• Preserve delegation lineage across agent hops Keep the original human authorisation visible through each downstream step so that agent-to-agent handoffs remain attributable and reviewable.
• Monitor privilege drift continuously Track the permissions agents actually use versus the permissions they are granted, and treat divergence as a governance defect rather than a harmless optimisation.

Key takeaways

• Agentic AI risk is emerging because enterprises are deploying agents into production faster than they are building controls that can govern runtime behaviour.
• The article’s central governance failure is that static IAM, quarterly reviews, and shared credentials do not match how agents actually make access decisions.
• The most effective response is to govern identity at the moment of action, with traceable delegation, runtime policy, and enforced tool access boundaries.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Privilege Drift: Privilege drift is the gradual gap between the permissions an identity was meant to have and the permissions it actually retains. In AI agent environments, drift grows quickly because roles are reused, tasks change, and lifecycle reviews often lag behind deployment velocity.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• MCP proxy: An MCP proxy is a middle layer that sits between an AI agent and MCP servers, forwarding requests, enforcing policy, and often logging activity. In technical terms, it mediates Model Context Protocol traffic, can normalize tool calls and responses, and helps control authentication, authorization, auditing, and data exposure across connected resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.