Agentic AI governance needs dynamic controls, not static IAM

At a glance

What this is: This discussion says agentic AI cannot be governed safely with static IAM because agents make runtime decisions, chain across tools, and change the control problem from identity alone to context, intent, and containment.

Why it matters: IAM, PAM, and security architecture teams need to treat agent behaviour as a dynamic authorisation and containment problem, because the usual assumptions about stable assets, deterministic policies, and accountable operators do not hold.

Context

Agentic AI creates a governance gap because traditional IAM assumes known assets, stable behaviour, and policies that can be fixed ahead of time. Once an agent can decide which tool to call, when to call it, and how to chain actions, static authorisation no longer describes the actual risk.

In OXSecurity’s analysis of the VibeSecCon Returns 2026 discussion, the issue is not just who is allowed to access a system. The problem is how access is scoped, approved, observed, and contained while the system is still making runtime decisions.

That shift matters for NHI governance because agents are ephemeral software identities that can act, fail, and be restarted far faster than conventional review cycles can react. The article’s starting position is typical of the current market debate, not an edge case.

Key questions

Q: What breaks when agentic AI relies on static IAM assumptions?

A: Static IAM breaks when the system can decide new steps at runtime. In agentic flows, the necessary scopes may not be known until the agent inspects a task, calls a tool, or chains into another service. That makes fixed permission modelling incomplete and creates gaps between design-time approval and actual execution.

Q: Why do AI agents require contextual authorisation instead of static entitlements?

A: Because the agent’s next action is not fully knowable at provisioning time. Context such as task purpose, target system and human requester helps decide whether the action should be allowed now. Static entitlements treat the agent like a predictable service account, which is too broad for dynamic runtime behaviour.

Q: How do security teams know whether containment is actually working?

A: They should test whether the identity can still execute privileged actions after revocation, not just whether the API call succeeded. A working containment model prevents re-escalation, blocks credential regeneration, and remains effective even when the target is polling for state changes. If any of those fail, containment is only partial.

Q: What should organisations do first when shadow AI appears in the environment?

A: Organisations should treat the tool as an unmanaged identity, then decide whether it is allowed to handle business data at all. The first 24 to 72 hours should focus on discovery, containment, and policy enforcement at the access boundary. If the tool cannot be governed inline, it should be denied by default.

Technical breakdown

Why static IAM fails for agentic AI

Traditional IAM assumes the operator and the operation are knowable before execution. Agentic systems break that assumption because they can select tools, chain actions, and adapt their behaviour mid-session to reach a goal. That means the security question is no longer just “who has access,” but “what should this actor be allowed to do in this exact context, with this exact intent, right now.” In practice, the control point moves from provisioning to runtime authorisation. The mechanism is closer to dynamic decisioning than to static entitlement management, because the risky part is not mere possession of a credential, but what the agent does with it once a workflow starts. Practical implication: move authorisation decisions closer to action execution and scope them to the current task.

Practical implication: move authorisation decisions closer to action execution and scope them to the current task.

Scoped identity, action-level authorisation, observability, and containment

The article describes four controls that work together rather than as separate checkboxes. Scoped identity limits what an agent can inherit. Action-level authorisation forces approval on high-impact operations. Deep observability captures prompts, tool calls, and command context so teams can reconstruct intent after the fact. Containment reduces blast radius through segmentation and isolation. The architecture matters because any one control on its own leaves a gap. Identity without containment still allows damage. Observability without approval still records the wrong thing happening. Approval without scoped identity still leaves too much standing power. For agentic systems, the control plane has to combine identity, decision, telemetry, and isolation as one runtime governance layer. Practical implication: design these four controls as a single operating model, not separate programme tracks.

Practical implication: design these four controls as a single operating model, not separate programme tracks.

Shadow AI as an agent supply chain problem

Shadow AI in the article is not just unmanaged usage. It is a supply chain problem because agents, models, skills, hooks, and MCP-connected tooling can enter the environment without formal approval and then expand the attack surface faster than governance can track. That changes how security teams should think about discovery. The issue is not only unknown software, but unknown runtime behaviour attached to it. The article’s call for a centralized build-fail policy, edge visibility, and a runtime feedback loop reflects that reality: if the organisation cannot see what was introduced, where it runs, and how it behaves, then policy arrives too late. Practical implication: treat sanctioned and unsanctioned agents as one governed supply chain.

Practical implication: treat sanctioned and unsanctioned agents as one governed supply chain.

NHI Mgmt Group analysis

Static IAM is the wrong control model for agentic behaviour: The article shows that agentic systems invalidate the assumption that identity can be authorised once and then left alone. Once an actor can choose tools and sequence actions at runtime, the control problem shifts from access assignment to decision control. Practitioners need to recognise that static entitlements describe only the starting condition, not the security state.

Context and intent are becoming first-class authorisation inputs: OXSecurity’s panel discussion points to a shift away from identity as the only authorisation primitive. That is the right direction because the same credential can be safe or unsafe depending on what the agent is trying to do and what context surrounds the action. The governance implication is that authorisation policy now has to reason about purpose, not only principal.

Containment is the real boundary of trust in agentic systems: The article makes clear that observability and approval matter, but containment determines whether a mistake becomes an outage. That is a material change for identity governance because blast radius, not just entitlement scope, becomes the control outcome that matters. Identity blast radius: the range of damage an agent can cause before a human can intervene; practitioners should design for the smallest possible one.

Shadow AI is a governance discovery problem, not just an inventory problem: The hard part is not counting known agents. It is finding the coding agents, skills, hooks, and MCP-connected components that entered outside formal review and now behave like live identity-bearing systems. That means discovery, policy enforcement, and runtime feedback need to operate together, or the organisation will keep governing only the subset it already knows about.

The accountable human may no longer be the useful security boundary: The article’s attribution problem shows that multi-agent chains weaken the old habit of tracing every outcome back to the original deployer. That does not remove accountability, but it does mean governance has to track system behaviour at the level where action actually occurs. The implication is that identity governance for agentic systems must be built around execution paths, not just ownership records.

From our research library:

• Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
• Read next: Agentic AI Identity Guide

What this signals

Agentic governance will converge on runtime control points, not static access reviews: Access review cadences assume privileges persist long enough to be certified. Agentic systems can request, use, and discard privilege inside a single task, which means the control has to move to issuance, approval, and containment at execution time. For IAM and PAM teams, that is a design change, not a tuning exercise.

Shadow AI is now an identity discovery problem: The difficult part is not only that unknown agents exist, but that they behave like active identity-bearing systems once they are connected to tools and data. The programme consequence is that inventory, policy enforcement, and runtime feedback have to be integrated, or governance will keep missing the agents that matter most.

Context-aware authorisation will become the practical norm for autonomous workflows: As agentic adoption expands, organisations will need to decide which actions require explicit approval, which can proceed under scoped identity, and which must be blocked at containment boundaries. That creates a new operating model for identity security, one that blends authorisation, observability, and blast-radius control.

For practitioners

• Define scoped identities for every agent Give each agent its own narrowly bounded identity, eliminate shared credentials, and remove standing access wherever the task can be completed with task-scoped privilege.
• Require approval for high-impact actions Place explicit human or policy approval gates on destructive, external, or irreversible operations so the agent cannot self-authorize consequential steps.
• Build full agent observability Record prompts, tool calls, MCP interactions, and command context so security teams can reconstruct intent, not just events, after unexpected behaviour.
• Contain agents by design Use segmentation, isolation, and blast-radius limits so a misbehaving agent can be stopped and restarted without spreading damage across the environment.
• Treat shadow AI as an intake control problem Enforce a centralized build-fail policy for unapproved agents and skills, and pair it with edge visibility plus a runtime feedback loop.

Key takeaways

• Agentic AI breaks the assumption that identity can be governed only through static entitlements, because runtime decisions and tool chaining change the actual control surface.
• The article points to four linked controls as the emerging operating model: scoped identity, action-level authorisation, observability, and containment.
• For practitioners, the practical shift is to govern agent behaviour at execution time and limit damage through isolation, approval gates, and complete runtime visibility.

Key terms

• Scoped identity: An identity that is constrained to a specific task, workflow, or service boundary. For AI systems, the concept is essential because it ties access to purpose, limits blast radius, and makes revocation and audit meaningful.
• Resource-Level Authorisation: A control pattern where each application or service decides whether a subject should be allowed to act. The decision is based on identity, context, and policy rather than on network location. This is the practical mechanism that makes zero trust enforceable in real environments.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.