TL;DR: Agentic AI systems can access tools, data, and applications to complete multi-step tasks, which expands attack surface and makes prompt manipulation, overreach, and multi-agent failure more consequential, according to Commvault's podcast conversation with Dr. Reid Blackman. The governance problem is no longer whether AI can act, but whether access, monitoring, and accountability keep pace with that action.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Commvault's blog post: Agentic AI changes the security problem from content generation to systems that can act, with access-driven risk now outpacing conventional IAM controls.
Why it matters: IAM, PAM and NHI teams need to account for AI systems that request, use and chain access across multiple tools, because governance models built around static identities do not cleanly fit agentic behaviour.
Context
Agentic AI refers to AI systems that can take actions, use tools and complete multi-step tasks, not just generate responses. That shift matters because the security question moves from output quality to the governance of access, delegation and monitoring across connected systems.
The article frames a governance gap rather than a product problem: traditional IAM assumes identities are relatively stable, while agentic systems can expand and chain privileges dynamically across applications, data stores and other agents. That is a genuine identity, NHI and agentic AI intersection because the security boundary is no longer only the user, but the machine actor making decisions at runtime.
Key questions
A: Security teams should treat agents as active systems, not passive chat interfaces. Start with least privilege, strict tool scoping, and authenticated identity for every agent. Add workflow logging, session management, and human review for high impact actions. The goal is to limit what an agent can do, trace what it did, and stop unsafe tool use before it reaches production systems.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.
Q: What are the warning signs that agent-to-agent workflows are becoming unsafe?
A: Look for unclear ownership, broad delegated permissions, undocumented handoffs and agents that rely on each other’s outputs without policy checks. These signals indicate that trust is being inherited rather than enforced. When that happens, one weak link can propagate bad instructions or bad data through the workflow.
Q: How do organisations decide when an autonomous agent needs approval versus direct execution?
A: Use the sensitivity of the action, not the sophistication of the model, to decide. Reading findings may be allowed directly, but configuration changes, production access, or cross-system actions should trigger escalation or denial outside the model. The right test is whether the requested action can be safely bounded before execution begins.
Technical breakdown
Why agentic AI breaks stable-identity assumptions
Agentic systems behave like software entities that can choose actions, call tools and continue across multiple steps, which makes them closer to runtime actors than classic application sessions. Traditional IAM often assumes a known principal, a defined request, and a reviewable access trail. Agentic behaviour disrupts that model because the system may decide which tool to use next, when to escalate, and how to combine data from several sources. Once that happens, the control problem shifts from authenticating a single login to governing an identity that can act repeatedly within one task context.
Practical implication: Treat the agent as a governed runtime principal, not as a normal user session.
How prompt attacks and tool access become a single risk path
Prompt attacks matter because they can steer an agent toward actions that were not intended by the operator, especially when the agent already holds access to tools and data. The weakness is not the prompt alone, but the combination of natural-language instruction, delegated permissions and automatic execution. That creates a new failure mode where the attacker does not need direct system compromise if the agent can be induced to misuse legitimate access. In practice, access scope and instruction integrity become one linked control surface.
Practical implication: Bind tool permissions to narrowly scoped task intent and inspect agent outputs before allowing irreversible actions.
Why multi-agent systems amplify governance failure
When one agent talks to another, the trust boundary becomes far less visible. Each agent may inherit assumptions about the other’s data handling, guardrails and privilege scope, yet those assumptions are rarely enforced in a common policy layer. The result is cascading risk: one bad decision, poisoned context or overbroad handoff can ripple across connected systems. This is a classic governance problem disguised as orchestration complexity, because the organisation may understand each component separately but not the combined behaviour of the chain.
Practical implication: Map agent-to-agent dependencies and define explicit trust and delegation rules before connecting systems.
Threat narrative
Attacker objective: The attacker wants to use the agent’s own delegated access and decision-making to perform unsafe actions, expose information or amplify errors across connected systems.
- Entry occurs when an attacker influences an agent through crafted prompts or other input that the system accepts as actionable context.
- Credential access and tool abuse follow when the agent uses its legitimate permissions to reach systems, data sources or connected services it should not have combined in that way.
- Escalation happens when the agent propagates mistakes or bad instructions through other agents and workflows, widening the blast radius beyond the original interaction.
- Impact is organisational misbehaviour or data exposure driven by legitimate access that was steered, not stolen, into the wrong action path.
Breaches seen in the wild
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic AI creates an identity governance problem before it creates a model-risk problem. The article shows that the central issue is not whether the model can generate useful output, but whether it can be trusted with tools, data and chained action. That moves the control question into IAM, PAM and NHI governance, because the runtime actor is no longer a passive application. Practitioners should govern the agent as a privileged machine identity with explicit scope and accountability.
Prompt integrity and authorization are now coupled controls. In agentic systems, a manipulated instruction can become an authorised action if the agent already holds broad access. That means conventional separation between content safety and access control is too thin for production use. Security teams need to treat instruction handling, privilege assignment and action approval as one policy domain, not three separate reviews.
Multi-agent trust gaps will expose the weakest delegation chain. The article’s warning about agents talking to other agents is important because each handoff can multiply uncertainty about policy, provenance and data handling. That is the emerging delegation trust gap: organisations assume one agent’s safeguards carry over to another, but they often do not. The practical conclusion is simple: connected agents need explicit trust boundaries, not implied confidence.
Conventional IAM will need a runtime governance layer for non-human actors. Static entitlements, periodic reviews and user-centric approval flows do not capture short-lived agent behaviour or task-specific delegation. This does not make IAM obsolete, but it does mean identity teams must add context-aware controls around issuance, action scope and revocation. The programme implication is clear: if the control plane cannot see agent intent and tool use, it cannot govern agentic risk.
From our research library:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
- Read next: Agentic AI Identity Guide
What this signals
Agentic AI changes the control point from authentication to delegated action. Security teams should expect identity governance to move closer to issuance time, because access reviews cannot explain behaviour that emerges inside a single autonomous task. The practical implication is that agent scope, delegation and revocation need to be managed as a runtime control problem, not a periodic audit.
Delegation trust gap: this is the emerging failure mode where organisations assume an agent-to-agent handoff preserves the same guardrails, even though each system may apply different policy, context and access boundaries. That gap will matter most where agents cross application, data and workflow boundaries without a common governance layer.
69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That signal is consistent with the operational reality described in the article: conventional IAM was built for stable principals, not software that decides, acts and delegates at runtime.
For practitioners
- Define agent identity and ownership Assign every production agent a named owner, a documented purpose and a bounded trust domain so accountability exists before deployment.
- Constrain tool access by task scope Limit each agent to the smallest tool set and data set needed for its specific workflow, then remove broad standing access that enables lateral action.
- Separate instruction handling from irreversible actions Require step-up approval or human review before an agent can execute destructive, financial or externally visible actions.
- Monitor agent-to-agent handoffs Log prompts, delegated context and downstream calls so teams can trace how one agent influenced another across a workflow.
- Test failure paths before scaling autonomy Run red-team style scenarios for prompt injection, tool misuse and cascading agent errors before expanding production authority.
Key takeaways
- Agentic AI turns access governance into a runtime problem because the system can act, delegate and chain tool use across workflows.
- The key failure mode is not just prompt manipulation, but the combination of broad permissions, autonomous execution and agent-to-agent trust.
- Identity teams need ownership, scope limits and action controls for agents before production rollout, or existing IAM reviews will miss the real risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents acting with delegated access and overbroad permissions. |
| ASI07 — Insecure Inter-Agent Communication | The article highlights risks when agents communicate and trust each other across systems. | |
| Recommendation — Bind agent privileges to explicit task scope and review delegation paths before production use. Define trust boundaries and policy checks for every agent-to-agent handoff. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Agentic systems still depend on how identities authenticate to tools and services. |
| NHI-05 — Overprivileged NHI | The article repeatedly warns that broader access dramatically increases risk for AI agents. | |
| Recommendation — Use strong authentication for every non-human principal that can invoke tools or access data. Reduce standing privileges for agents and scope access to the minimum task requirement. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The governance issue is whether permissions and entitlements still match agentic access patterns. |
| Recommendation — Continuously align agent entitlements to approved use cases and remove excess access promptly. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Agentic systems rely on credentials, tokens and other authenticators that must be governed across their lifecycle. |
| Recommendation — Manage agent authenticators with short lifetimes, rotation and revocation controls. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about governance, accountability and oversight for AI systems that take action. |
| MANAGE — Manage AI Risks | The article focuses on controlling operational AI risks such as misuse, overreach and cascading failures. | |
| Recommendation — Establish governance roles, review gates and accountability for agentic AI before deployment. Implement risk controls for prompt attacks, tool misuse and cross-agent failure propagation. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
- Agent-to-agent handoff: A transfer of work, data, or authority from one software agent to another. In security operations, this creates a control boundary that must preserve policy context, identity, and audit trails so that responsibility does not disappear between systems.
- Runtime Principal: A software entity that operates as an active security principal during execution, not just as a named account on paper. The concept matters because agentic systems can request, consume and release access dynamically, which makes static identity reviews incomplete.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It helps identity and security practitioners apply durable governance patterns to non-human actors and delegated access.
Published by the NHIMG editorial team on July 22, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org