TL;DR: An MCP-connected AI can create tenants, deploy rules, enable Git Sync, and generate keys from a single prompt, collapsing manual onboarding into minutes, according to LimaCharlie. That speed improves operations, but it also means identity, privilege, and audit assumptions must be rebuilt around agentic execution rather than human-paced workflows.
At a glance
What this is: This is a LimaCharlie demonstration of agentic AI provisioning a fully configured security tenant from a single prompt, with the key finding that onboarding, key creation, and configuration can be compressed into minutes.
Why it matters: It matters because IAM, PAM, and governance teams must treat agent-driven administration as a different operating model, where provisioning speed can outrun review, separation of duties, and change control.
Context
Agentic AI changes the control problem from assisted administration to delegated execution. In this example, a model connected through MCP is not just recommending configuration. It is creating tenants, generating keys, enabling integrations, and writing changes into version control.
For identity practitioners, the issue is not whether AI can help with onboarding. The issue is whether current governance assumes a human operator remains the decision point for provisioning, privilege assignment, and auditability. Once the agent acts directly, that assumption no longer holds.
Key questions
Q: What breaks when an AI agent can create tenants and keys directly?
A: Human-paced onboarding controls break because they assume provisioning is reviewed before state changes become durable. When an agent can create tenants, enable integrations, and generate keys in one execution path, the decision, the action, and the evidence all compress into a single machine-paced event.
Q: Why do agent-driven provisioning workflows increase governance risk?
A: They increase governance risk because the agent can cross multiple control domains in one run, including access, configuration, source control, and credential creation. That widens blast radius, makes separation of duties harder to preserve, and reduces the value of controls that depend on slow human review.
Q: What are the signs that agentic authorization is too broad?
A: Look for agents that can retrieve data across multiple resources, reuse a single session for unrelated steps, or rely on post-hoc restrictions instead of pre-checks. Those patterns usually mean the authorization boundary is too loose for delegated machine action.
Q: How do teams govern AI agents in aviation workflows?
A: Treat the AI workload as an authorisation subject with explicit limits on what it can request or trigger. The key is not whether the workload is automated, but whether the specific action is permitted in the current context. If an order, update, or approval exceeds policy thresholds, the workflow should require human review.
Technical breakdown
Prompt-to-provision workflows collapse manual tenant onboarding
The article shows a single prompt triggering a full tenant setup sequence. That sequence includes tenant creation, Sigma rules deployment, Git Sync enablement, repository creation, and key generation. Technically, this is not a helper workflow that drafts work for a human to approve. It is delegated execution through an API-backed agent with broad operational reach. The security consequence is that the trust boundary shifts from the person typing the prompt to the identity, scopes, and safeguards attached to the agent itself.
Practical implication: Treat prompt-driven provisioning as privileged automation and bind it to strict approval, scope, and logging controls.
MCP changes how identity is enforced across tools and environments
MCP gives the model a structured path to tools and data sources, which is why the agent can move from conversation to action. In this pattern, identity is no longer just an authentication event. It becomes an authorization chain that spans the model interface, the platform API, external repositories, and any generated secrets or keys. That creates a governance problem because each downstream system may see only a legitimate API call, while the upstream decision was made by a non-human actor.
Practical implication: Inventory every tool and repository the agent can touch, then govern the full delegation chain rather than each call in isolation.
Auditability depends on versioned state, not just logs
The demonstration emphasizes that configurations and detection rules are synced to a repository, which creates a versioned record of tenant state. That matters because agentic administration can move faster than conventional review cycles. If the system can create, alter, and replicate tenant baselines in minutes, then auditability has to come from durable state capture, change correlation, and attributable execution records. Without that, governance teams may have logs but still lack a defensible explanation of who or what changed the environment.
Practical implication: Require version-controlled change records for agent actions so review can track state, not just event logs.
Threat narrative
Attacker objective: The objective is to obtain broad administrative setup capability through delegated agent execution so infrastructure and credentials can be provisioned at machine speed.
- Entry occurs through a user prompt that is handed to an MCP-connected agent with direct access to the platform API.
- Escalation happens when the agent creates a tenant, deploys rules, enables Git Sync, and generates the keys needed to complete setup.
- Impact is a fully configured environment with replicated settings, versioned changes, and an operational baseline established without human-paced administration.
Breaches seen in the wild
- Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Prompt-driven provisioning is a governance event, not just a productivity gain. When an agent can create tenants, generate keys, and wire up version control from a single instruction, the control plane has effectively moved from human workflow to machine execution. That changes how privilege is assigned, reviewed, and attributed. Practitioners should treat agentic provisioning as a distinct governance class, not as faster automation.
Agentic identity breaks the assumption that provisioning intent is known in advance. Traditional IAM assumes the actor, scope, and sequence are defined before execution begins. Here, the agent decides the operational path at runtime, which means least privilege cannot be understood only at provisioning time. The implication is that identity governance must account for executable intent, not only assigned roles.
Runtime delegation creates an identity blast radius across tenant creation, secrets, and source control. A single prompt can cascade into multiple durable changes across systems that usually have separate approvals. That cross-system propagation is precisely where governance gaps emerge, because each control may look reasonable in isolation while the combined action set is much broader. Practitioners need to reason about blast radius across the full delegation chain.
Version control improves traceability, but it does not by itself solve authorization. Syncing configuration into Git creates a record, yet the question remains whether the agent should have been able to create that state in the first place. Logging and reproducibility are useful, but they sit after the authorization decision. The practitioner task is to align delegated execution with policy before the repository becomes the permanent source of truth.
Identity blast radius: Agentic administration expands the impact of one identity decision across provisioning, secrets generation, and environment replication. That makes the unit of governance larger than a single API call. Security teams should rethink who or what is allowed to create persistent tenant state at all.
From our research library:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Agentic provisioning requires a different trust model. Once a model can create tenants, keys, and repository links from a single prompt, the relevant control question becomes who may trigger durable state changes, not just who may log in. IAM teams should expect this pattern to surface in more admin tooling and should plan for runtime delegation reviews instead of only periodic access recertification.
Runtime delegation is the new governance boundary. The important distinction is between a workflow that assists a human and one that executes across multiple systems on its own. That line determines whether change control, separation of duties, and audit evidence still mean what teams think they mean.
Identity blast radius: Agentic administration expands the effect of one permission decision across provisioning, secrets, and replication. That means security architecture has to measure how far one agent can carry authority, not just whether the individual API call was valid.
For practitioners
- Define agent provisioning boundaries Restrict which tenant-creation, rule-deployment, and key-generation actions an agent can execute without human approval. Map those actions to separate approval paths when the change creates durable tenant state.
- Inventory delegated tool access List every API, repository, and extension the agent can reach through MCP or similar orchestration layers. Tie each permission to an accountable owner and a revocation path.
- Make version control part of governance Require every agent-created tenant baseline and configuration change to land in versioned state with attributable change metadata. Use that record to separate execution evidence from operator identity.
- Separate secret creation from secret use Prevent the same agent session from both generating keys and using them to complete broader provisioning steps unless that chaining is explicitly justified and logged.
Key takeaways
- Agentic tenant provisioning turns AI from a recommendation layer into an execution layer that can alter durable security state.
- The main risk is not speed alone but the widening of identity blast radius across tenant creation, secrets, and source control.
- Governance has to move from reviewing completed changes to constraining who or what can create them in the first place.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centers on an agent using delegated privileges to create tenants and keys. |
| Recommendation — Constrain agent identities so they cannot expand privilege or create durable state outside approved scopes. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The agent acts like a non-human identity with broader access than a human reviewer would tolerate. |
| NHI-04 — Insecure Authentication | The workflow depends on agent access to APIs, keys, and repository actions that must be strongly bound to identity. | |
| Recommendation — Review agent permissions for overprivilege and remove any ability to create persistent tenant state without approval. Bind agent API access to strong authentication and revoke any credential path that cannot be attributed cleanly. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Service Identification and Authentication | The agent authenticates to platform APIs and supporting services as a non-human executor. |
| Recommendation — Apply IA-9 to authenticate agent-driven service calls and separate them from human user credentials. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is whether an agent may create tenant state under current entitlements. |
| Recommendation — Align agent permissions with PR.AA-05 so entitlements do not allow unchecked tenant creation or secret generation. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The demo includes key generation and movement across platform, repository, and configuration domains. |
| Recommendation — Map agent-enabled key generation and cross-system actions to credential access and lateral movement in detections. | ||
Key terms
- Agentic Provisioning: Agentic provisioning is the use of an AI agent to create or configure infrastructure directly rather than drafting work for a human operator. In identity terms, the control issue is whether the agent is allowed to make durable state changes, and under what approval, logging, and revocation rules.
- Delegated Execution: Delegated execution is when software is allowed to perform actions on behalf of a user, process, or business function. In NHI governance, the risk is that the delegated actor may chain actions beyond the original intent, so controls must focus on scope, approval, and revocation.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Runtime Delegation: The process by which an identity is allowed to choose actions, tools, or next steps while a task is in progress. In AI agent environments, runtime delegation is risky when it is broad, opaque, or disconnected from explicit policy, because the resulting behaviour may exceed the original intent.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 1, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org