Agentic AI security tenants expose new IAM and governance gaps

At a glance

What this is: The article demonstrates an agentic AI workflow that provisions and configures a security tenant end to end from a single prompt.

Why it matters: It matters because IAM, PAM, and NHI teams need governance models that account for AI-driven provisioning, key generation, and infrastructure changes at machine speed.

By the numbers:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.

👉 Read LimaCharlie’s blog on spin-up of a fully configured agentic AI tenant

Context

Agentic AI security changes the identity problem because the actor is no longer just a tool that recommends actions. In this pattern, an AI system can decide, sequence, and execute platform tasks such as tenant creation, rule deployment, and key generation through an API-connected control plane.

For IAM and NHI programmes, that means the governance question shifts from who may use a console to what an autonomous runtime can authorise, create, and persist without human pacing. The operational risk is not only speed, but the fact that identity boundaries are being crossed by software acting inside the control plane.

This is a familiar pattern in early agentic deployments: organisations want the efficiency of automated infrastructure work before they have adapted lifecycle, approval, and audit controls to match. That gap is typical, not exceptional, and it is where most governance failures begin.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do agentic AI workflows create new IAM risk compared with traditional automation?

A: Traditional automation usually follows fixed rules and predictable paths, so its access model is easier to review. Agentic workflows can choose actions, adapt to signals and trigger downstream systems in real time, which expands the effective trust boundary. That makes role assignment alone insufficient because the identity can accumulate authority through use.

Q: What breaks when AI workloads use NHI-style credentials without lifecycle control?

A: What breaks is reviewability and revocation. AI workloads can create, reuse, and hand off credentials faster than traditional governance cycles assume, so service accounts and tokens may persist beyond their intended purpose. Without a defined lifecycle, identity state becomes hard to validate and even harder to retire cleanly.

Q: How do teams keep version control from masking governance gaps in agentic operations?

A: Use version control for traceability, but pair it with identity controls that answer who authorised the change, which actor executed it, and whether the action stayed inside policy. A clean repo history does not prove the agent was correctly scoped or that its privileges were appropriate.

Technical breakdown

MCP-connected agent execution and API authority

Model Context Protocol connects an AI system to tools and data sources, but the security consequence depends on how much authority those tools expose. In this article, Claude Code uses the platform API to create tenants, deploy rules, and enable Git Sync. That is not simple automation of a fixed workflow; it is an agentic execution path where a prompt initiates a chain of actions across identity, configuration, and source control. The key control issue is whether the API surface is bounded by task-specific entitlements or effectively grants broad operational authority.

Practical implication: scope MCP and API permissions to narrowly defined action sets, not broad platform administration.

AI-generated credentials and versioned tenant baselines

The workflow generates the necessary API keys and then links tenant configuration to a GitHub repository for replication. That combination matters because credential issuance, configuration state, and version control become part of the same operational flow. In NHI terms, the secret is no longer just an access token, but an enabling artifact for ongoing infrastructure change. If keys are created during runtime without strong ownership, expiry, and offboarding, the control plane accumulates persistent machine identity risk even when the initial tenant setup looks clean.

Practical implication: treat AI-generated keys as governed NHIs with explicit ownership, expiry, and revocation rules.

Consistent baselines versus control-plane drift

A replicated tenant baseline can improve consistency, but it also creates a reusable pattern for privilege propagation. Once an AI can spin up a working tenant from a prompt, the real governance question is whether every replicated instance inherits the same controls, approvals, and logging. Version control helps only if the authoritative configuration is also tied to identity, change approval, and rollback discipline. Without that linkage, teams get repeatability without assurance, which is a dangerous trade in security infrastructure.

Practical implication: bind tenant replication to change control and recertification, not just to source control history.

NHI Mgmt Group analysis

Agentic SecOps creates an identity governance problem, not just an automation problem. When an AI can create tenants, generate keys, and modify security posture from a single prompt, the actor is exercising runtime authority rather than merely triggering a workflow. That changes the governance surface from task completion to delegated execution, which is a different control model. Practitioners should treat this as an NHI governance issue with agentic characteristics, not as a conventional orchestration feature.

Least privilege for agentic systems fails if entitlement is defined only at provisioning time. The 2026 Infrastructure Identity Survey shows that 70% of organisations grant AI systems more access than they would give a human employee performing the same job, which is a direct sign that access design is already drifting beyond human comparators. The problem is not just excess scope, but the assumption that access can be safely assigned before the agent's actual action path is known. That assumption collapses when the actor decides its own sequence of actions at runtime.

Named concept: agentic control-plane drift. This is the tendency for AI-driven operational workflows to expand from a narrow task into tenant creation, key generation, integration setup, and repository linkage inside the same trust boundary. Each added step widens the blast radius of the original prompt. Security teams should recognise that the control plane itself becomes the identity object to govern, not just the credentials used to reach it.

Version control improves traceability, but it does not replace identity governance. A Git-backed baseline can show what changed, yet it does not answer who or what was authorised to make the change in the first place. That distinction matters for MSSPs and platform teams because reproducibility without accountability is still a governance gap. The practitioner conclusion is that auditability and authorisation must be designed together, or the baseline becomes a replayable risk pattern.

Agentic AI will force IAM, PAM, and NHI teams to converge faster. The same workflow touches identity issuance, elevated platform access, configuration management, and lifecycle control. That means the old organisational split between platform automation and identity governance will become harder to defend. The field needs a shared operating model for machine-issued authority before these workflows become standard practice.

From our research:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
• A separate finding from the same survey shows that 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years.
• That trajectory makes agentic governance a near-term operating requirement, which is why our OWASP NHI Top 10 analysis is a useful next reference.

What this signals

Agentic control-plane drift: as AI systems move from recommendation into execution, the governance boundary shifts from workflow automation to delegated authority. Security teams should assume that tenant provisioning, key creation, and configuration changes may all be reachable from a single prompt unless permissions are explicitly decomposed and reviewed.

The bigger programme signal is that identity teams can no longer treat infrastructure automation as a separate discipline. Where AI can change state directly, IAM, PAM, and NHI governance need shared policy language, shared logging, and shared offboarding rules for machine-issued authority.

With 70% of organisations granting AI systems more access than a comparable human role, per The 2026 Infrastructure Identity Survey, the baseline is already too permissive for many agentic use cases. That gap will show up first in provisioning, then in secrets, and finally in the audit trail.

For practitioners

• Inventory every prompt-to-action path Map which prompts can trigger tenant creation, API key issuance, rule deployment, or integration changes. Classify each path by the identities, approvals, and logs it traverses so you know where an agent can cross from advisory behaviour into execution authority.
• Constrain agent permissions to task-scoped APIs Split platform APIs so the agent can only invoke the minimum set of endpoints needed for a specific onboarding task. Remove broad administrative reach from general-purpose assistant contexts and require explicit approval for any action that creates new infrastructure or secrets.
• Govern AI-generated secrets as NHIs Register every AI-created key, token, or certificate as a managed non-human identity with owner, expiry, rotation, and revocation controls. Do not let runtime-generated secrets bypass the same lifecycle rules applied to service accounts and other machine identities.
• Tie replicated baselines to change control Require every reusable tenant baseline to pass through configuration review, access certification, and rollback testing before it is cloned. Git history alone is not enough if the same baseline can be reissued across customers without revalidation.

Key takeaways

• Agentic AI turns tenant onboarding into a governed identity problem because the system can create infrastructure, keys, and integrations from a single prompt.
• Machine-speed execution exposes a governance gap when access, approvals, and lifecycle controls are still designed around human-paced workflows.
• Security teams should bound agent authority, manage AI-generated secrets as NHIs, and tie replicated baselines to identity-aware change control.

Key terms

• Agentic SecOps: A security operations model in which AI systems can coordinate tasks and take bounded actions across alert handling, investigation, and response. The critical question is whether those actions are governed, explainable, and reversible enough to fit enterprise control requirements.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Agentic Control-Plane Drift: The gradual expansion of an AI workflow from a narrow task into broader infrastructure authority. The risk is not simply that the agent acts quickly, but that the control plane starts absorbing tenant creation, secrets, integrations, and source control into one trust boundary.
• AI-Generated Secret: A credential, token, or key created during an AI-driven workflow rather than by a human operator. These secrets should be treated as managed non-human identities because they can persist after the task ends, carry standing privilege, and create hidden offboarding obligations.

What's in the full article

LimaCharlie’s full blog covers the operational detail this post intentionally leaves for the source:

• The exact prompt and resulting tenant-provisioning sequence from Claude Code, including the order of platform actions.
• The mechanics of Git Sync setup and how the repository is linked to tenant configuration state.
• The platform-specific workflow for generating the keys needed to complete the onboarding flow.
• The demonstration context for MSSPs that need repeatable tenant baselines across multiple clients.

👉 LimaCharlie’s full post shows the prompt, workflow sequence, and tenant configuration steps in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.