Agentic AI security at RSAC 2025 shows autonomy changed the threat model

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Lasso Security's blog post: RSAC 2025 showed that agentic AI has moved into operational reality, and security now has to govern autonomous action, inherited privilege, and runtime guardrails rather than only model outputs.

Why it matters: IAM, PAM, and NHI teams need to reassess controls built for static workflows because autonomous systems can take actions, trigger tools, and expose data paths outside traditional review cycles.

Context

Agentic AI is software that can choose actions, call tools, and decide when to act without waiting for a human to approve each step. That changes the identity problem from authenticating a user or workload to governing runtime behaviour, delegated authority, and the scope of autonomous actions.

At RSAC 2025, the article's central claim was that this shift is no longer theoretical. The governance gap is that many identity and access models still assume access is assigned ahead of time and reviewed later, while autonomous systems can move through privilege, tool use, and data access inside a single task.

For IAM, PAM, and NHI programmes, the question is no longer whether AI can be gated by a policy. It is whether current controls can describe, constrain, and audit an identity that acts before a human review cycle can catch up.

Key questions

Q: What breaks when AI systems are governed like static applications?

A: Lifecycle drift breaks the model. AI systems change through training, fine-tuning, updates, and retirement, so static controls miss where risk enters and where access should end. That creates blind spots for data exposure, connector reuse, and post-deployment misuse.

Q: Why do agentic AI systems increase initial access and privilege abuse risk?

A: Because they can chain valid access into multiple tool calls without needing a human to approve each step. If a secret is exposed or a role is overbroad, the agent can turn that access into data movement, service interaction or recursive task execution. The risk rises when access outlives the task that created it.

Q: How can organisations tell whether AI governance is actually working?

A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped. If those four things are missing, the programme has policy language but not operational control. Auditors will notice the gap quickly.

Q: What is the difference between AI security controls and NHI controls?

A: NHI controls focus on identities such as service accounts, keys, tokens, and certificates. AI security controls extend that model to systems that can reason, select tools, and sometimes act autonomously. In practice, the strongest programmes use NHI discipline as the baseline and then add governance for runtime decision-making.

Technical breakdown

Why agentic AI changes the identity control plane

Agentic AI systems are not just chat interfaces with better orchestration. When they can initiate actions, select tools, and continue execution without human approval, they begin to behave like autonomous identities rather than static applications. That creates a different control problem: the security team must govern who or what is allowed to act, under what conditions, and with what delegated authority. In that model, identity is no longer only about login. It becomes about action boundaries, tool boundaries, and decision boundaries that can shift at runtime.

Practical implication: move identity governance from one-time provisioning toward runtime authorisation boundaries for autonomous actors.

How runtime monitoring differs from traditional access review

Traditional access review assumes a privilege exists long enough to be certified, recertified, or removed on a schedule. Agentic systems can acquire credentials, use tools, and release access within one execution window, which means the artefact may already be gone by the time a review runs. That is why monitoring has to observe the behaviour of the session itself, including trigger conditions, tool calls, and downstream actions. For autonomous systems, the most useful evidence is often behavioural and temporal, not just entitlement-based.

Practical implication: instrument agent sessions and tool invocations as first-class audit evidence, not just stored entitlements.

Why privilege escalation and data leakage are the core failure modes

The article repeatedly points to privilege escalation, data leakage, and system abuse because these are the direct consequences of letting autonomous systems inherit broad access. Once an agent can interact with enterprise APIs and internal data sources, any overbroad scope becomes an execution path rather than a theoretical risk. This is why contextual access control and real-time policy enforcement matter. The security boundary has to follow the action, not just the application, or the agent will inherit more authority than the task requires.

Practical implication: constrain agent privilege to task-scoped boundaries and validate every high-risk tool call in real time.

NHI Mgmt Group analysis

Autonomous identity behaviour collapses the assumption that access is stable long enough to be reviewed: that assumption was designed for humans and static service accounts, not actors that decide and act within a single runtime session. Once action and review no longer share the same time horizon, entitlement governance loses its evidentiary basis. The implication is not merely faster review. It is that the review model itself no longer describes the actor accurately.

Agentic AI turns least privilege into a moving target, not a provisioning rule: the article's focus on privilege escalation and tool abuse shows that privilege can no longer be treated as a fixed state granted at setup time. For autonomous systems, permission scope is shaped by context, memory, and action sequence, which means overprivilege emerges at execution time rather than only at onboarding. Practitioners need to stop treating privilege as a static attribute and start treating it as a runtime boundary problem.

Runtime monitoring is the new control surface for AI identity governance: visibility into what agents do, who triggers them, and which tools they call is more valuable than after-the-fact inventory alone. That is because the risk is not just that an agent exists, but that its behaviour can drift into sensitive workflows before a human sees a report. The field should now judge AI governance by whether controls can observe and constrain actions as they happen.

Agentic AI security sits at the intersection of NHI, PAM, and AI governance rather than replacing any of them: the article is strongest when it treats autonomous systems as identities that inherit access, exercise privilege, and need compliance boundaries. That makes the problem bigger than model safety and narrower than generic cloud security. The practical conclusion is that identity teams, not only AI teams, now own part of the control plane.

Named concept: runtime authority drift: autonomous systems can move from approved purpose to expanded action scope during execution, especially when tool access, memory, and delegated permissions intersect. That drift is what makes agentic AI different from ordinary automation and why static guardrails fail to capture the real risk. Practitioners should treat the drift itself as the governance object.

From our research library:

• Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
• Read next: Agentic AI Identity Maturity Model

What this signals

Runtime authority drift: agentic systems challenge the assumption that privilege remains stable long enough for periodic review, so identity programmes need control points at issuance and at execution. That changes how teams think about entitlement evidence, audit trails, and delegated access across NHI and AI governance.

The practical shift for security leaders is to treat autonomous behaviour as an identity event, not only an application event. That means visibility, policy enforcement, and offboarding logic must follow the agent's action path rather than stop at the account record.

According to the 2026 Infrastructure Identity Survey, 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems. That level of consensus shows the control model is already behind the deployment model.

For practitioners

• Map autonomous actions to task-scoped authority Define exactly which actions an agent may take for a given task, then remove any standing privilege that is not required for that task boundary.
• Instrument runtime behaviour for auditability Capture tool calls, trigger events, data access, and decision points so the agent's session can be reviewed as an execution record.
• Separate discovery from delegated execution Inventory shadow AI and then classify whether each system merely uses AI or actually acts with autonomous authority before assigning governance.
• Tighten guardrails around API-based decision chains Treat every API hop, memory reference, and downstream call as part of the identity boundary when an agent can continue without human approval.
• Align compliance evidence to runtime controls Document how policy enforcement, monitoring, and red teaming produce evidence for AI governance obligations rather than relying on model declarations.

Key takeaways

• Agentic AI changes the identity problem because systems can now act, select tools, and continue execution without waiting for human approval.
• The biggest governance gap is that many IAM and PAM models still assume access is stable long enough to be reviewed after the fact.
• The practical response is to move control points to runtime and treat agent behaviour as evidence, not just the entitlements behind it.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Runtime authority: Runtime authority is the permission an AI system has while it is actively deciding and acting, not just when it is approved. In governance terms, it is the point where access, tool use, and action scope become operational, which is why build-time review alone cannot prove safety.
• Runtime authority drift: A failure mode where an actor begins with a narrow, acceptable level of access or intent, then expands its effective authority as the session unfolds. In agentic systems, this often appears when the platform keeps trusting the interaction after the actor has already started to deviate from the original purpose.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.