Agentic AI governance needs dynamic controls, not static IAM

At a glance

What this is: This is an analysis of why agentic AI invalidates static security assumptions and why practitioners are moving toward scoped identity, action-level authorisation, observability, and containment.

Why it matters: It matters because identity, PAM, and governance teams now need to control software actors that decide and act at runtime, not just users or fixed service accounts.

👉 Read OXSecurity's analysis of agentic AI governance and runtime containment

Context

Agentic AI changes the identity problem because the actor can choose actions at runtime, chain tools, and operate faster than human approval cycles. In that model, access is no longer just about who or what authenticates, but about what the actor is allowed to do in a specific context, at a specific moment, with a specific intent.

That creates direct pressure on IAM, NHI governance, and security architecture. Existing controls built for deterministic policy enforcement struggle when the system being governed is ephemeral, distributed, and able to expand its own operational surface through sanctioned and unsanctioned agents alike.

Key questions

Q: How should security teams govern AI agents that can choose tools at runtime?

A: Security teams should govern runtime agent choice as an access event, not as a simple application action. That means scoping permissions to the task, limiting token lifetime, logging every tool decision, and blocking the agent from reaching systems outside its approved context. Static roles alone are not enough when the execution path changes on each run.

Q: Why do traditional IAM controls struggle with autonomous AI agents?

A: Traditional IAM assumes predictable users or static machine accounts, but AI agents can act independently, interact with multiple systems, and generate new access needs over time. That makes static role assignment and one-time approval insufficient. Security teams need continuous evaluation, not just initial authentication and authorization.

Q: What do security teams get wrong about Shadow AI?

A: They often treat Shadow AI as an approval problem for software, when it is usually also an identity problem. The hidden risk can be an undocumented token, an over-permissioned service account, or an autonomous agent with unreviewed reach. Inventory the identity layer before you decide the tool is the issue.

Q: Who is accountable when a multi-agent system causes damage?

A: Accountability cannot stop at the original deployer if the system hands off decisions across several agents and tools. The governance model has to reflect the whole delegation chain and the specific action that caused the impact, not just the first human involvement.

Technical breakdown

Why identity-based authorization breaks down for agentic AI

Traditional authorisation assumes the subject is stable, the action is predictable, and policy can be decided before execution. Agentic systems break that model because they choose tools, sequence actions, and adapt during execution. In multi-agent chains, the original deployer is not the full decision-maker, and identity alone no longer explains risk. The relevant unit of control becomes the action in context, not the named actor on the credential.

Practical implication: move from static role checks toward runtime approval for high-impact actions.

Scoped identity, observability, and containment as the core control plane

The emerging architecture combines scoped identity, action-level authorisation, deep observability, and containment. Scoped identity prevents shared or standing credentials from becoming ambient power. Observability must capture prompts, tool calls, and command context so teams can reconstruct intent after the fact. Containment limits blast radius when behaviour becomes unsafe, which matters more in agentic systems than in conventional application security because the actor can escalate through tool use rather than privilege assignment.

Practical implication: design for blast-radius isolation before expanding agent privileges.

Shadow AI and the supply chain problem in agentic environments

Shadow AI is not just an inventory issue. It is a supply chain and governance problem because unsanctioned agents, hooks, models, and MCP servers can enter production without the controls that teams expect from approved software. When the runtime surface expands faster than policy distribution, security teams lose the ability to answer what is running, what it can touch, and what happens if it is compromised.

Practical implication: centralise build-fail policy and runtime visibility across sanctioned and unsanctioned agent components.

Threat narrative

Attacker objective: The objective is to turn legitimate agent access into broader operational control and cause damage through tool-enabled action chains.

1. Entry occurs when an agent or connected tool gains sanctioned access to tokens, APIs, or runtime hooks that were not intended for its actual behaviour.
2. Escalation follows when the agent chains tools or actions beyond the scope originally assumed by the human deployer, bypassing the practical limits of identity-only authorisation.
3. Impact arrives when the agent performs high-consequence operations, expands the blast radius, or executes harmful changes faster than humans can intervene.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static IAM assumptions do not survive agentic execution. Identity-based authorisation was designed for actors whose intent can be inferred from a request and whose actions are bounded by predefined workflows. That assumption fails when the actor can select tools, chain decisions, and change direction mid-session. The implication is not simply stronger policy, but a recognition that the old authorisation model no longer describes the behaviour being governed.

Action-level control is the new governance boundary for autonomous software behaviour. In agentic environments, the question is no longer whether a credential is valid, but whether a specific action is acceptable in context. That shifts the centre of gravity away from standing permissions and toward contextual, high-friction approval for consequential operations. Practitioners should treat this as a change in control architecture, not a tuning exercise.

Containment is more important than perfect prediction. The article’s strongest operational point is that misbehaving agents can be restarted, so systems should be built to absorb failure rather than assume it can be eliminated. That is a useful governance correction for teams accustomed to deliberative incident handling. Practitioners should define consequence thresholds up front and engineer for rapid isolation.

Shadow AI is the governance blind spot that makes agentic risk look bigger than the approved stack. The hardest exposure is often not the sanctioned agent under review, but the unsanctioned one already connected to production systems. That creates a visibility gap across the build pipeline, runtime layer, and supply chain control plane. Practitioners should assume their current inventory is incomplete until proven otherwise.

Identity blast radius becomes the decisive metric when agentic systems can self-extend through tool use. Once a system can invoke APIs, hooks, and downstream services on its own, the real question is how much damage any single compromised or misbehaving actor can do before containment stops it. That makes blast-radius design a first-class governance concern for both NHI and agentic AI programmes.

From our research:

• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which shows how weak identity inventory remains even before agentic complexity is added.
• That visibility gap is why Top 10 NHI Issues is a useful next step for teams mapping governance, rotation, and offboarding gaps.

What this signals

Identity blast radius: once agents can chain tool use across systems, the governance question shifts from access allocation to damage containment. Teams should expect their existing IAM and PAM controls to answer only part of the problem, because runtime behaviour now matters as much as provisioning state.

With 79% of organisations already reporting secrets leaks, according to Ultimate Guide to NHIs, the next failure mode is not merely leaked credentials. It is leaked credentials plus autonomous or semi-autonomous runtime behaviour that can exploit them faster than teams can respond.

Programme owners should treat agentic AI inventory, scoped identity, and containment as one operating model rather than three separate initiatives. That framing aligns with the NIST Cybersecurity Framework 2.0 because govern, identify, protect, detect, respond, and recover all have to work against a moving target.

For practitioners

• Define scoped identities for every agent Assign each agent a distinct identity with no shared credentials and no standing access. Keep permissions narrow enough that a compromised or misrouted agent cannot inherit another actor’s privileges through convenience.
• Require action-level approval for high-impact operations Put explicit approval gates on actions that can change infrastructure, move data, or touch production systems. Base the gate on the consequence of the action, not on the identity that triggered it.
• Instrument full agent observability Log prompts, tool calls, command context, and MCP interactions with enough detail to reconstruct intent after the event. If the audit trail cannot explain what the agent was trying to do, the control is incomplete.
• Build containment before expanding agent scope Use segmentation, blast-radius isolation, and kill-and-restart resilience so a dangerous agent can be removed without waiting for human debate. Design the system so a clean restart is normal, not exceptional.
• Centralise policy for sanctioned and shadow agents Create a build-fail policy and runtime feedback loop that covers approved agents, unsanctioned agents, and their supporting hooks or servers. Visibility at the edge is the only way to stop the control plane from fragmenting.

Key takeaways

• Agentic AI breaks the assumptions behind static identity-based authorisation because the actor can choose tools and sequence actions at runtime.
• The practical controls are scoped identity, action-level approval, observability, and containment, with blast radius management doing the heavy lifting.
• Shadow AI makes the problem worse because unmanaged agents expand the runtime attack surface faster than governance can inventory it.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Sequence-Level Authorisation: Sequence-level authorisation is control over the full chain of actions an autonomous agent can take, not just the permissions on each individual request. It matters because an agent can combine several valid calls into an outcome that no single policy check would flag.
• Containment: The phase of incident response that stops an incident from spreading while preserving the evidence needed to investigate it. In cloud environments, containment often starts with identity revocation, isolation of workloads, and protection of logs before any system is terminated or cleaned up.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

What's in the full article

OXSecurity's full article covers the operational detail this post intentionally leaves for the source:

• Panel context from VibeSecCon Returns 2026, including the practitioner discussion that shaped the framework
• Detailed examples of how observability is captured across prompts, tool calls, and MCP interactions
• Operational discussion of build-fail policy, runtime feedback loops, and control-plane enforcement
• The source article's framing of how teams should respond when an agent behaves unexpectedly in production

👉 OXSecurity's full post covers the panel discussion, control framework, and runtime response model in more detail

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.