Agentic AI security extends NHI governance to autonomous agents

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Opti's blog post: Agentic AI security treats autonomous agents as non-human identities and says they need lifecycle governance, least privilege and runtime controls.

Why it matters: This matters because agent permissions, tool access and delegated actions can now change faster than periodic access reviews, creating governance gaps across NHI, autonomous and human identity programmes.

Context

Agentic AI security is the governance layer for AI systems that can choose actions, select tools and execute multi-step work without waiting for a human at each step. That behaviour creates a control problem that looks like NHI governance, but with faster decision cycles and wider tool reach.

The key issue is not simply that these systems are automated. They can authenticate, inherit permissions, call APIs and persist across workflows, which means identity controls have to follow the agent across provisioning, review, approval and deprovisioning. NHI identity issues is the right baseline for understanding that shift.

For identity teams, the important distinction is that the agent is not just a workload. It is a runtime decision-maker with access paths that can expand through prompts, tools, integrations and delegation chains, so governance has to cover both identity state and operational behaviour.

Key questions

Q: How should organisations govern AI agents as non-human identities?

A: Organisations should classify AI agents as NHIs and place them under the same identity governance controls used for service accounts and APIs. Assign unique identities, bind each agent to least privilege, and enforce JIT access, short-lived credentials, and strong authentication. Monitor every action, log tool use, and require approval for high-risk tasks. Review ownership, purpose, and permissions regularly, with revocation when behavior changes or the agent is no longer needed.

Q: Why do access reviews miss privilege creep in AI agents?

A: Access reviews miss privilege creep in AI agents when reviewers only see assigned roles or static entitlements, not the tools, prompts, datasets and API scopes the agent actually used. Agents often accumulate broad tokens, shared service accounts, inherited permissions and one-off exceptions that are never recertified. Usage telemetry, combined with owner attestations and periodic scope revalidation, exposes unused or excessive access.

Q: Why do prompt injection attacks create governance risk for AI agents?

A: Prompt injection creates governance risk because the model often sits in the control path between text input and tool execution. If attackers can change what the model treats as authoritative, they can influence access decisions, data exposure, or downstream actions without compromising a traditional account. That makes prompt provenance and instruction hierarchy part of AI identity governance.

Q: How should security teams prevent confused deputy attacks in multi-user AI agents?

A: Security teams should enforce authorization at the moment of execution, not at prompt time. Use a runtime that evaluates the agent identity, the delegated user identity, and the task context before each tool call. Keep credentials isolated from the model context window, and require the effective permission to be the intersection of agent and user rights.

Technical breakdown

Agent identity discovery and inventory

Agentic AI governance starts with finding every agent identity, whether it was formally registered or created through SaaS automation, MCP integrations, service accounts or API connections. Discovery has to capture owner, purpose, authentication method, credentials, connected tools, data sources and lifecycle status. Without that inventory, security teams cannot distinguish approved agents from shadow agents that are already active in business workflows. The technical point is that agent identity is distributed across platforms, so one system rarely has the full picture. That makes inventory a control plane for downstream governance, not just an asset register. See the Agentic AI Identity Guide.

Practical implication: Build a single inventory of agent identities, connected tools and lifecycle state before you try to review access or enforce policy.

Runtime authorization and tool governance

Agentic systems differ from conventional applications because they can choose tools and APIs at runtime rather than following a fixed execution path. That means authorization cannot rely only on the model's output or a pre-approved workflow. The security boundary has to sit at the tool and API layer, where requests can be checked against agent identity, user context, resource scope and current task. Prompt injection, deceptive tool responses and unsafe arguments all become more serious when an agent can act immediately on them. Tool trust therefore becomes part of identity governance, not just application security. See the Agentic AI Security Guide.

Practical implication: Enforce tool allowlists and API-layer authorization so the agent cannot expand its reach through a prompt or integration alone.

Why access reviews miss privilege creep in agents

Privilege creep in agentic environments is harder to spot because granted access does not always show what the agent actually uses. Usage telemetry, last-used signals and action logs are what reveal dormant entitlements, inherited roles and permissions that survived a task change. In other words, the control problem is not simply excessive access at provisioning time. It is access that remains plausible long after the operational need has changed. That makes entitlement review a behavioural exercise, not a paperwork exercise, because agents can accumulate permissions across systems faster than periodic certification cycles can correct them. Read Top 10 NHI Issues.

Practical implication: Use usage telemetry to remove dormant permissions and avoid relying on periodic certification as the only signal of excess access.

Threat narrative

Attacker objective: The attacker wants to abuse a privileged agent as an execution proxy so unauthorized actions appear to come from a legitimate identity.

1. Entry begins when an AI agent is given broad permissions, connected tools and credentials that reach into enterprise systems without enough scoping.
2. Escalation happens when prompt injection, malicious integrations or confused deputy conditions steer the agent into actions beyond the user's intent or the agent's original task.
3. Impact follows when the agent can move data, change access or trigger sensitive operations at machine speed across multiple systems before human review can intervene.

Breaches seen in the wild

• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI security is NHI governance with a faster blast radius. The control problem is not new, but the runtime decision loop changes the exposure window. An agent can request, combine and use access within a single task, which means the real question is how much authority the identity can exercise before any human checkpoint exists. Practitioners should treat agents as governed machine identities, not as a separate security category.

Agent identity discovery is the prerequisite control. A programme cannot govern what it cannot inventory, and shadow agents are especially easy to miss because they can emerge through SaaS platforms, integrations and automation frameworks. That makes identity discovery the first governance control, not a hygiene step. The practitioner implication is straightforward: no approved inventory, no defensible review, no reliable deprovisioning.

Runtime authorization replaces static trust assumptions. Least privilege still matters, but agentic systems break the assumption that access can be defined once and reviewed later. If the agent can select tools at runtime, then the control boundary must move to the moment of action. Security teams should think in terms of task-scoped authority, continuous validation and delegated action tracing.

Access review processes assume access persists long enough to be reviewed; autonomous agents can acquire and release privileges within a single session. That assumption fails when the actor decides and executes on its own timeline. The implication is not simply tighter review cadence. It is that governance models built around stable privilege states do not fully describe the agentic identity problem, so practitioners need a different operational lens for who held what authority, when and for how long.

Named concept: runtime governance gap. This is the space between granting an agent permission and proving that its actual behaviour stayed inside that permission. Prompt injection, malicious integrations and confused deputy conditions all exploit that gap because the agent's next action is not fully knowable at provisioning time. Practitioners should treat that gap as a first-class governance problem, not an edge case.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Multi-Agent and A2A Security Guide

What this signals

Runtime governance gap: the central challenge is the space between what an agent is allowed to do and what it actually does at execution time. As agents gain tool selection and action authority, identity programmes have to validate behaviour continuously instead of assuming that a certification cycle will catch drift.

Identity teams should expect agent inventories, entitlement graphs and audit trails to become operational controls rather than documentation artefacts. The practical shift is from static approval records to evidence of current authority, current usage and current delegation.

Where agent ecosystems span multiple tools and workflows, the strongest programmes will separate approval for access from approval for action. That distinction matters because a permission to retrieve data is not the same as permission to move it, transform it or disclose it.

For practitioners

• Inventory every agent identity Track owner, purpose, authentication method, credentials, connected tools, data sources and lifecycle status for every AI agent in scope.
• Move authorization to the tool layer Enforce allowlists, parameter validation and API-layer checks so runtime tool selection cannot exceed the task that was approved.
• Apply least privilege to agent access Scope each agent to the minimum resources, operations and data needed for its current task, then remove inherited access that is no longer required.
• Require approval for high-impact actions Place explicit human approval gates around privilege changes, deletions, financial actions and production modifications that would create material business impact.
• Review agent permissions continuously Use usage telemetry, last-used signals and entitlement changes to identify dormant access and privilege creep between formal review cycles.

Key takeaways

• Agentic AI security extends NHI governance into systems that can decide and act during execution, which changes how identity risk has to be measured.
• The main control gaps are shadow agents, excessive permissions, runtime tool misuse and privilege creep across connected systems.
• Practitioners should shift from periodic review alone to inventory, task-scoped authorization, continuous telemetry and lifecycle governance.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic AI Identity Maturity Model · Top 10 NHI Issues · Multi-Agent and A2A Security Guide

Key terms

• Agentic AI Security: Agentic AI security is the discipline of securing autonomous AI systems that can take actions, use tools, and chain decisions without direct human approval at each step. It covers identity and access management for AI agents, prompt injection defence, tool call governance, credential scoping, and runtime monitoring. As agentic systems acquire real-world authority, API access, file writes, workflow triggers, the security model must treat them as non-human identities with explicit lifecycle controls, not trusted processes.
• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
• Confused Deputy Attack: An attack where a legitimate agent is tricked into using its own authorised access to perform an action the attacker could not do directly. The risk is highest when an agent has broad permissions and accepts untrusted inputs, allowing adversary-driven prompts or documents to redirect valid credentials toward harmful actions.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.