Agentic AI security risks outpace conventional IAM controls

At a glance

What this is: Commvault's podcast discussion frames agentic AI as a security and governance shift because AI systems can now take actions across connected tools, not just generate text.

Why it matters: For IAM, PAM, and NHI teams, the issue is that agent access and delegated privileges now behave more like identities that need lifecycle control, monitoring, and containment.

👉 Read Commvault's podcast discussion on agentic AI, trust, and cyber resilience

Context

Agentic AI is software that can choose actions, call tools, and complete tasks across connected systems. That changes the control problem from output review to access governance, because the system is now acting inside business applications rather than only producing content. In identity terms, these systems start to resemble non-human identities with delegated access and broader blast radius.

Commvault's discussion uses that shift to explore a familiar security failure pattern in a new form: the more systems an AI agent can reach, the harder it becomes to predict misuse, prompt manipulation, or unintended side effects. The article is best read as a governance prompt for IAM, PAM, and AI security teams, not as a product notice.

Multi-agent behaviour adds another layer because one system's mistake can propagate into others. That makes identity boundaries, approval scopes, and monitoring thresholds more important than model novelty. The article's starting point is typical of the broader market conversation, which is moving from AI experimentation toward control design.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do agentic AI systems complicate existing IAM and PAM controls?

A: They complicate them because IAM and PAM were built around stable identities, human-paced approvals, and entitlements that are reviewed after use. Agentic systems compress decision-making into runtime, which means access can be consumed, combined, and discarded before a review cycle ever sees it. That makes static privilege models incomplete for autonomous execution.

Q: What do organisations get wrong about AI agent risk scores?

A: They often treat risk scores as reporting rather than decision input. A useful score should change something concrete, such as access scope, tool restrictions, logging depth, or approval requirements. If the number does not lead to an operational change, it is not governance evidence.

Q: Which frameworks should organisations use for autonomous AI governance?

A: Use OWASP agentic and LLM guidance for application risk, NIST AI RMF for governance structure, and MITRE ATLAS for adversarial technique mapping. Then translate those frameworks into operational controls that restrict tool access, define approval boundaries, and produce auditable runtime evidence. Frameworks help classify the risk, but enforcement must happen in execution.

Technical breakdown

Why agentic AI changes the access-control problem

Agentic AI differs from a chat interface because it can invoke tools, read data, and execute actions with runtime discretion. That means the security question is not just whether the model says the right thing, but whether it can access the right systems at the right time for the right purpose. Once an agent has API access, database access, or workflow permissions, it can operate across trust boundaries that were designed for humans or static service accounts. The result is a new class of delegated access that behaves like an identity, even when it is composed of model logic plus orchestration.

Practical implication: Treat AI agents as governed identities with explicit entitlements, session limits, and revocation paths.

Prompt attacks and tool misuse in connected AI systems

Prompt attacks work by steering model behaviour through crafted inputs, but the real security risk increases when prompts are tied to tools, plugins, or external data sources. In that setup, a manipulated instruction can trigger actions rather than just generate text. The failure mode is not limited to jailbreaks. It includes overbroad tool permissions, weak contextual filtering, and missing guardrails between the agent and the systems it can touch. This is why AI security has to cover both model behaviour and access design.

Practical implication: Restrict tool invocation to task-scoped permissions and log every agent action against policy.

Multi-agent systems and compounding failure paths

Multi-agent systems allow one agent to hand off work to another, which improves throughput but also creates dependency chains that are hard to reason about. If one agent misclassifies intent, exposes data, or calls the wrong tool, downstream agents may treat that output as trusted input. The architecture starts to resemble a supply chain for decisions, with each agent inheriting assumptions from the previous one. That makes oversight harder because the point of failure may be several hops away from the visible user interaction.

Practical implication: Map agent-to-agent trust boundaries before deployment and require traceability across delegation chains.

Threat narrative

Attacker objective: The attacker wants to convert a trusted AI workflow into a controllable execution path that leaks data or performs unintended actions.

1. Entry begins when a malicious or malformed prompt influences an agent that already has access to tools, data, or other systems.
2. Escalation occurs when that agent uses delegated permissions to reach beyond the intended task scope, including interacting with adjacent services or other agents.
3. Impact follows when the manipulated agent exposes information, triggers incorrect actions, or propagates errors across connected workflows.

NHI Mgmt Group analysis

Agentic AI is becoming a non-human identity problem, not just an AI safety problem. Once an agent can access tools, data, and systems, the governance question shifts from model output quality to delegated privilege and containment. That brings IAM and PAM into the center of AI governance, because an agent with persistent access behaves like an identity that needs lifecycle control. Practitioner conclusion: treat agent access as a governed identity class with explicit ownership.

Prompt attacks matter because they turn policy into an input problem. Traditional application security assumes the user is asking for an action and the system decides whether to comply. In agentic AI, the system may reinterpret or extend the instruction across multiple tools, which creates a larger surface for manipulation. Practitioner conclusion: enforce policy at the tool layer, not only at the prompt layer.

Multi-agent systems create delegation debt. Each additional agent expands the number of trust decisions, handoffs, and inherited assumptions that must be monitored. That creates a governance burden similar to third-party access, where the risk is not one identity but the chain between identities. Practitioner conclusion: do not scale agent collaboration faster than your ability to trace delegated actions.

There is an AI governance gap between enthusiasm and accountability. The article reflects a market where organisations want the productivity of agentic systems before they have the controls to explain, restrict, and audit their behaviour. This is where frameworks like NIST AI RMF, OWASP Agentic AI Top 10, and OWASP NHI Top 10 converge. Practitioner conclusion: build the control model first, then expand the agent footprint.

Named concept: delegated access without human review window. Agentic systems can acquire and exercise permissions quickly enough that conventional review cycles miss the actual risk window. The problem is not just standing privilege, but standing opportunity for action before oversight can intervene. Practitioner conclusion: shorten approval and revocation paths to match machine-speed execution.

What this signals

Delegated access is becoming the core control issue for agentic AI. As more organisations put tools and data behind AI workflows, the question is no longer whether the model is capable. It is whether the identity, authorization, and logging layers can still explain what the agent did. That puts identity governance, not just model governance, on the critical path.

AI governance teams should expect control expectations to tighten around runtime visibility. The combination of agentic behaviour and external tool use means review cycles built for human users will miss the moment of misuse. Teams should align their programme design with the NIST AI Risk Management Framework and the OWASP Agentic AI Top 10.

Delegation trust gap: the control problem is no longer only whether an AI agent is allowed to act, but whether the organisation can prove what it was allowed to do at the moment it acted. That pushes logging, entitlement scoping, and ownership into one governance surface.

For practitioners

• Define AI agent identity ownership Assign a business owner, technical owner, and approval boundary for every agent that can call tools or access data. Record the agent's purpose, allowed systems, and revoke conditions in the same inventory you use for privileged accounts.
• Scope agent permissions to tasks Replace broad connector access with task-scoped permissions, short-lived tokens, and explicit tool allowlists. The goal is to ensure the agent can only act within the smallest useful boundary for the current job.
• Log delegated actions end to end Capture prompt, tool call, data access, and downstream agent handoff events in one trace so investigations can reconstruct how a decision happened. Correlate these logs with identity events and privileged access records.
• Test for prompt and delegation abuse Red-team the agent with prompt injection, tool misuse, and agent-to-agent trust failures before wider rollout. Include scenarios where one compromised agent attempts to influence another through shared context.
• Review AI controls against identity frameworks Map agent governance to NIST AI RMF, OWASP Agentic AI Top 10, and OWASP NHI Top 10 so ownership, logging, and revocation are handled as control requirements rather than informal guidance.

Key takeaways

• Agentic AI expands the security problem from content generation to delegated action across business systems.
• The most relevant control gap is runtime governance of identity, privilege, and tool access, not model novelty.
• Organisations that cannot trace agent decisions and revoke access quickly will struggle to contain misuse at machine speed.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Prompt Attack: An attempt to influence an AI system by shaping the input in ways that bypass safeguards, change behaviour, or reveal protected information. In connected systems, the risk is not limited to wording, because the manipulated response can trigger tools, access data, or initiate downstream actions.
• Multi-Agent System (MAS): An environment in which multiple autonomous AI agents interact, collaborate, and delegate tasks. MAS dramatically increases NHI complexity — each agent requires a managed identity, and a single compromise can propagate across the entire mesh.

What's in the full article

Commvault's full podcast discussion covers the conversational detail this post intentionally leaves for the source:

• The full episode includes the Amazon recruiting example and the reasoning behind stopping an AI project when the outcome could not be corrected.
• It also covers the discussion of AI agents interacting with other agents, including why that complicates monitoring and trust boundaries.
• The source goes deeper on prompt attacks, multi-agent risk, and the ethical questions raised by agentic decision-making.
• Listeners get the full back-and-forth between Nathan Macintosh and Dr. Reid Blackman on how organisations should think about responsible AI adoption.

👉 The full Commvault episode expands on prompt attacks, multi-agent systems, and practical AI risk questions.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It gives security practitioners a common control language for delegated access, privilege, and lifecycle management.