Agentic AI security needs identity-centric access controls

At a glance

What this is: This is Delinea's analysis of why agentic AI security requires identity-centric access controls, with the core finding that traditional RBAC and static privilege models do not fit AI-to-AI interactions.

Why it matters: It matters because IAM, PAM, and NHI teams now have to govern AI identities, broker credentials, and prove what an agent was authorised to do before autonomous workflows become routine.

By the numbers:

• 66% of organisations actively use agentic AI in IT operations, according to Delinea's 2025 AI in Identity Security report.
• 56% encounter shadow AI issues at least monthly, according to Delinea's 2025 AI in Identity Security report.

Context

Agentic AI introduces a governance problem that looks familiar at first but behaves differently in practice. These systems can act on behalf of an organisation, exchange credentials with other systems, and make runtime decisions that are not well described by static roles alone.

The core issue for identity teams is that access is no longer just assigned to a named user or workload and left in place. In agentic AI environments, authorisation needs to be understandable, auditable, and tied to intent, because visibility gaps turn every interaction into a governance blind spot.

Delinea's article frames the current starting point as common but immature: agentic AI is already in use, yet the access model around it is still catching up. That makes the article a useful snapshot of an emerging governance gap rather than a finished control model.

Key questions

Q: What breaks when agentic systems are governed only by roles and static permissions?

A: Static roles fail when the same agent needs different permissions for different tasks in the same session. A broad role can either over-authorise the agent or force teams to create too many special cases, both of which increase risk. IBAC addresses that gap by tying permission to declared purpose and current context instead of standing identity alone.

Q: Why do agents increase governance risk even when they use valid credentials?

A: Valid credentials do not solve the governance problem when the actor can act continuously and outside the human review cycle. Risk rises because the question shifts from whether the credential is legitimate to whether each autonomous action should be allowed in real time. That is a policy and accountability problem, not just an authentication problem.

Q: How do security teams know if agentic AI controls are failing?

A: The main signs are session drift, repeated retry loops, unauthorized tool calls, and behaviour that diverges from the documented task sequence. If the agent keeps moving through steps after intent-to-tool alignment weakens, the system is drifting beyond its control envelope. In practice, teams should measure the full execution path, not isolated prompts.

Q: Should organisations re-evaluate IAM and PAM for agentic AI deployments?

A: Yes, because agentic systems can inherit credentials and exercise privileged tools in ways that traditional IAM and PAM reviews do not fully capture. Organisations should reassess whether their current models account for ephemeral tasks, delegated authority, and machine-speed execution. The key test is whether access can be constrained to the exact task and revoked immediately afterward.

Technical breakdown

Why RBAC breaks down for agentic AI

Role-based access control works when the actor's permissions can be defined in advance and remain stable long enough to govern them. Agentic AI changes that assumption because the system may choose actions, request credentials, and interact with other systems dynamically at runtime. The result is a mismatch between static entitlement design and variable operational behaviour. Identity-centric controls therefore have to focus on the agent as the subject of authorisation, not just the workflow or application it touches.

Practical implication: move beyond role assignment and define access around the agent's runtime identity, task scope, and approval boundary.

AI-to-AI credential brokering and tokenised trust

AI-to-AI credential brokering is a control pattern for verifying digital credentials when one agent interacts with another system or agent on behalf of the organisation. The article points to token-based credentials and digital certificates as the trust mechanism, but the governance challenge is broader than authentication alone. Teams need to know which agent is speaking, what it is authorised to do, and whether that trust can be audited after the fact. Without that, machine-to-machine exchange becomes opaque delegated access.

Practical implication: design brokered trust so every agent interaction is attributable, authenticated, and reviewable across systems.

PAM for agent behaviour and high-risk actions

Privileged Access Management becomes relevant when an agent can reach sensitive systems or initiate high-impact actions. The article highlights two PAM functions that matter here: anomaly detection for unusual access patterns and real-time human approval for sensitive operations. That combination addresses both compromise and scope drift, because a trustworthy agent still needs guardrails when its behaviour deviates from the approved pattern. This is less about restricting automation and more about preserving control over elevated action paths.

Practical implication: place high-risk agent actions behind PAM checkpoints that can detect abuse and pause execution when needed.

Threat narrative

Attacker objective: The objective is to use opaque or over-privileged agent behaviour to reach sensitive systems and data without reliable accountability.

1. Entry occurs when an organisation deploys agentic AI into IT operations or other workflows without clear visibility into the identities and permissions involved.
2. Escalation occurs when an agent can exchange credentials, act through delegated access, or touch sensitive resources without a robust audit trail.
3. Impact follows when shadow AI, overbroad access, or unseen agent behaviour produces unauthorised actions, governance blind spots, or compromised operations.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-centric access control is now the control plane for agentic AI. Agentic AI does not simply add another workload class to existing IAM. It collapses the assumption that authorisation can be modelled once and reused unchanged, because the actor can choose actions at runtime. The practical implication is that IAM and PAM teams need to treat agent identity as an operational subject with its own governance boundary.

Visual identity mapping becomes a governance requirement, not a documentation exercise. The article's call to map AI personas, agent IDs, and model metadata reflects a deeper need: CISO teams cannot govern what they cannot name and distinguish. That matters across human IAM, NHI, and agentic systems because ambiguity in identity labeling becomes ambiguity in accountability. The practical implication is that identity inventories must separate people, workloads, and agents cleanly enough to support audit and approval.

Standing privilege is the wrong default for autonomous execution paths. The more an agent can decide and act without human pacing, the less defensible persistent access becomes. Access that remains available between tasks expands the window for misuse, drift, or shadow behaviour. The practical implication is that privileged access for agents must be treated as episodic and tightly bounded, not as a permanent operating condition.

Agentic AI exposes a governance gap around intent, not just authentication. A system can prove who it is and still do the wrong thing if authorisation is not tied to approved use cases. This is where traditional access models break down: they authenticate the entity but do not sufficiently constrain the objective. The practical implication is that identity governance for agents has to include intent validation alongside credential checks.

Runtime governance gap: what breaks here is the assumption that access can be understood from static entitlements alone. Delinea's article shows that agentic systems need dynamic controls because their behaviour is shaped during execution, not just at provisioning time. That means the field is moving from access assignment to access governance in motion. The practical implication is that practitioners should redesign control sets around runtime authorisation, auditability, and approval boundaries.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Agentic AI security is becoming an identity governance issue, not just a model-risk conversation. As runtime behaviour becomes more dynamic, the programme risk moves from authentication alone to the ability to explain and constrain what an agent was authorised to do in the moment.

Runtime governance gap: access reviews assume a stable entitlement can be inspected after assignment. Agentic systems can acquire, use, and shed permissions inside operational windows that do not fit traditional review cadences, so governance has to move closer to issuance and approval.

Only 13% of organisations feel extremely prepared for the reality of agentic AI, according to the 2026 Infrastructure Identity Survey. That preparedness gap is a warning that control design is lagging adoption, not a sign that the problem is hypothetical.

For practitioners

• Inventory AI identities and classify them by risk Build a discover-and-classify process for AI agents across hybrid and multi-cloud environments, then separate low-risk helpers from agents that can touch sensitive systems or data.
• Replace standing access with task-scoped access Grant agents only the permissions needed for a defined task and remove persistent access between tasks, especially where the agent can reach privileged systems.
• Map agent personas and authorization relationships Document agent IDs, AI personas, and training model metadata so reviewers can trace which identity acted, what it was allowed to do, and which system it touched.
• Add PAM checkpoints for high-impact actions Require real-time human approval for sensitive agent actions and use anomaly detection to flag unusual access patterns or privilege abuse.
• Log agent actions with cryptographic integrity Preserve tamper-evident logs for agent decisions and actions so investigators can reconstruct both intent and execution after an incident.

Key takeaways

• Agentic AI pushes identity teams beyond static role assignment because runtime behaviour, delegated access, and machine-to-machine trust all need governance.
• The article pairs adoption with governance gaps, showing that visibility and shadow AI remain material issues even where agentic systems are already in use.
• Practitioners should treat agent identity, PAM checkpoints, and intent-bound access as the core controls, not optional add-ons.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• AI-To-AI Credential Brokering: The controlled exchange of credentials between systems that act on behalf of an organisation. In agentic environments, the key issue is not just authentication, but whether delegated trust remains limited to the intended task, system, and time window rather than spreading across the full chain of action.
• Action Validation: A control that checks whether a requested action is allowed before the system carries it out. For autonomous agents, validation is more than logging or alerting because it must evaluate the action in context and block unsafe execution before tools or data are touched.
• Visual Digital Identity Mapping: Visual digital identity mapping is the practice of documenting relationships between identities, permissions, and systems in a way reviewers can actually follow. For agentic AI, it helps separate human users, workloads, and agents so accountability does not disappear inside delegation chains.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.