Agentic AI is outpacing identity control and visibility

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Delinea's blog post: Agentic AI is moving faster than identity control, visibility, and governance, with Delinea highlighting a readiness gap between confidence and actual oversight.

Why it matters: IAM, PAM, and NHI teams need to account for autonomous runtime behaviour, because AI systems that request access, execute workflows, and adapt in real time create control gaps that traditional review and approval models do not catch.

By the numbers:

• 87% of organizations say their identity security posture is prepared to support AI at scale.
• 46% of respondents acknowledge that their identity governance around AI systems is deficient.
• 82 to 1 is the ratio by which non-human identities already outnumber human identities.
• 90% of organizations report gaps in identity visibility across their environment.

Context

Agentic AI now behaves like a runtime identity problem, not just an application feature. It requests access, executes workflows, and adapts while systems are live, which means identity control has to govern decision, access, and action together rather than as separate events.

The article argues that confidence and control are diverging. Organizations may believe their posture is ready for AI at scale, yet the operational reality is that visibility, delegation trust, and privilege explanation are still lagging behind autonomous behaviour.

For IAM and PAM teams, the governing question is no longer whether AI is present. It is whether the identity model can still explain and constrain what an agent does once it has been allowed to act.

Key questions

Q: What breaks when AI SOC autonomy is not tightly governed?

A: The platform can take actions that outgrow the permissions, escalation rules, and accountability model the organisation intended. That creates response risk, audit gaps, and potential overreach into identity, containment, or remediation workflows. Autonomy without scoped privilege is just automation with weaker controls.

Q: Why do agent-to-agent workflows create more identity risk than single-agent automations?

A: Because each agent handoff introduces another authorisation decision, another trust boundary, and another place where accountability can blur. When agents validate or trigger actions for each other, the policy question is no longer just who started the task, but whether each downstream agent was permitted to receive, interpret, and act on the request.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.

Q: Should organisations loosen access controls to support AI automation?

A: Only with caution. The article shows that speed pressure often drives broader permissions and longer access durations, but that approach increases exposure when agents operate continuously. The safer decision is to constrain the privilege window, preserve attribution, and prove that the access model still matches the agent’s actual task.

Technical breakdown

Why agentic AI collapses the access-review model

Agentic AI changes identity from a static entitlement problem into a runtime execution problem. Traditional access review assumes a user or service account holds privileges long enough for ownership, intent, and use to be inspected after the fact. An agent that requests access, uses it, and adapts in real time compresses that whole sequence into one operating window. That makes approval history less informative unless the control plane can observe issuance, context, and delegated use together. In practice, governance has to understand not just who received access, but how the agent selected actions while using it.

Practical implication: Design review and approval controls around runtime issuance and delegated use, not only around periodic certification.

Agent-to-agent delegation needs explicit trust boundaries

The article points to trust verification gaps in agent-to-agent delegation, including so-called agent swarms. That matters because delegation chains introduce a second layer of identity reasoning: one agent may hold permissions while another triggers the task, and neither identity alone explains the full action path. Without explicit trust boundaries, the system can inherit privileges in ways that are difficult to trace or constrain. This is where identity becomes more than authentication. It becomes an authorisation graph with changing participants and unclear accountability for each step.

Practical implication: Map delegation chains and define which agent is allowed to initiate, approve, and execute each class of action.

Visibility gaps become more dangerous when non-human identities scale

Delinea cites a visibility problem that is already common across environments and becomes sharper in AI contexts. When non-human identities outnumber human identities and activity is dynamic, the issue is not just volume. It is that privileged actions are harder to explain in real time, especially when identities are ephemeral, unsanctioned, or no longer clearly owned. The result is a control environment where the organisation can detect that something happened, but not reliably explain why it happened or whether the identity should still exist.

Practical implication: Treat unexplained privileged activity as an inventory and ownership problem, not only a monitoring problem.

Threat narrative

Attacker objective: The objective is to turn autonomous access into sustained privileged execution across enterprise systems without timely human oversight.

1. Entry occurs when an AI agent is granted access to enterprise systems and begins operating inside normal workflows.
2. Escalation happens when the agent can modify its own security policies or inherit broader permissions through delegation and standing access.
3. Impact follows when the compromised or unmanaged agent performs privileged actions across multiple systems faster than governance can intervene.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI exposes an identity control problem, not just an AI adoption problem: the article shows that systems are already acting, delegating, and adapting inside enterprise workflows. That means identity is no longer a perimeter service around AI use, it is the runtime control plane for AI behaviour. Practitioners should stop treating agentic AI as a future-state issue and govern it as an active identity domain now.

The confidence gap is the real governance signal: Delinea reports strong readiness sentiment alongside deficient governance, and that mismatch is more telling than either number alone. Confidence without traceable control usually means identity teams can describe AI ambition better than they can explain AI authorisation. The practitioner takeaway is that assurance claims need to be tested against actual delegation, privilege scope, and observability.

Agent-to-agent trust is becoming a new NHI governance category: the article’s examples of agent swarms and self-modifying policies show that authorisation is no longer a one-to-one relationship. Once one agent can trigger another, the governance question shifts to how trust is granted, inherited, and revoked across machine actors. That makes delegated trust an operational discipline, not a policy statement.

Standing privilege becomes more dangerous when the actor can choose when to use it: the article notes that organizations feel pressure to loosen controls for AI automation, even while acknowledging the exposure created by standing access. That is the core NHI problem in agentic form. The more autonomous the actor, the less tolerable persistent privilege becomes because the timing of use is no longer human-paced.

Runtime visibility is now a prerequisite for accountability: if organisations cannot explain why a non-human identity performed a privileged action, they do not have governable identity state. That gap is not only a monitoring weakness. It means access decisions are being made faster than the organisation can reconstruct them, so identity teams must re-centre governance on live attribution and contextual enforcement.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Agentic AI identity governance is shifting from policy design to runtime control: the main programme risk is not whether AI is present, but whether teams can still explain and constrain action once a machine actor starts selecting and executing work. That pushes identity leaders toward live attribution, delegation tracing, and issuance-time controls rather than reliance on periodic review.

AI security confidence paradox: 87% of organizations say their identity security posture is prepared to support AI at scale, yet only 13% of organizations feel extremely prepared for the reality of agentic AI. That gap suggests many programmes are still measuring AI readiness with controls that were designed for slower, more predictable identity behaviour.

Agentic AI governance now depends on visible ownership of machine actors: when unsanctioned agents, ghost agents, and delegated permissions appear faster than teams can explain them, the identity programme loses auditability. Practitioners should expect ownership, inventory, and contextual enforcement to become the deciding controls for AI operations.

For practitioners

• Instrument runtime agent visibility Track which agent initiated each action, which identity it used, and which downstream systems accepted that request so privileged behaviour is attributable in real time.
• Define delegation boundaries for agent swarms Set explicit rules for which agent may trigger, approve, or inherit access from another agent, and block implicit privilege propagation between autonomous components.
• Reduce standing access for non-human identities Replace persistent permissions with contextual, task-scoped access so an agent does not retain broad privileges after the work it was authorised to do is complete.
• Require ownership for every privileged non-human identity Assign a human owner, business purpose, and review path to each AI-related identity so unexplained actions can be traced to a responsible control point.

Key takeaways

• Agentic AI turns identity into a runtime governance problem because agents request access, execute actions, and adapt in the same operating window.
• The article highlights a readiness paradox, with 87% claiming AI-scale readiness while only 13% feel extremely prepared for agentic AI.
• Identity teams need live attribution, delegation boundaries, and task-scoped access if they want AI automation without losing control.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.
• Runtime Attribution: The ability to explain which identity initiated an action, what it was allowed to do, and how that action propagated across systems. For autonomous or semi-autonomous AI, runtime attribution is essential because after-the-fact logs may show activity without revealing the decision path.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.