Agentic AI turns IAM into runtime policy over workflows

At a glance

What this is: NHI Mgmt Group's analysis, drawing on IndyKite's blog post: Agentic AI forces IAM beyond login-time identity checks and toward runtime authorization that follows workflow context, delegation and trust.

Why it matters: IAM teams, IGA leads and security architects need to rethink how policy, delegation and audit evidence work when an agent can cross tools, data sets and other agents before acting.

Context

Traditional IAM assumes a relatively stable path from identity to permission to application. Agentic AI disrupts that assumption because the actor can move across tools, APIs and other agents before the final action is taken. That changes the control question from who authenticated to whether the action should proceed at all.

The governance gap is not just more permissions, but more context. Purpose, consent, provenance, data sensitivity and trust all affect whether an agent should act, yet those signals often sit in separate systems. Agentic AI identity has to connect those signals at decision time if runtime access is to remain defensible.

That makes this an identity governance problem as much as an AI problem. The article's starting point is a typical enterprise pattern: identity controls exist, but they were not built for workflow-spanning machine actors that make decisions at speed.

Key questions

Q: How should teams govern agents that use both model calls and tool calls?

A: Treat the full workflow as one identity problem, not two separate control problems. The same agent should have a stable principal, a shared policy model, and one correlated audit trail across both gateways. If model governance and tool governance cannot be joined without manual reconciliation, the control plane is incomplete.

Q: Why does delegation context matter in agentic authorization?

A: Delegation context matters because an agent’s authority must be tied to the human owner, task, timeframe, tool scope, and data scope that justified the grant. Without that context, a token or service account can be reused outside its intended purpose, breaking least privilege and making revocation, audit, and incident containment harder. Good controls include scoped credentials, JIT access, and explicit approval records.

Q: What is the difference between authentication and authorization in agentic systems?

A: Authentication proves who or what is acting. Authorization decides what that identity may do, under which context, and for how long. In agentic systems, the distinction matters because the same identity can be authenticated once and still require repeated authorization as actions unfold.

Q: How should security teams implement agentic AI controls without giving systems unsupervised access too early?

A: Start by separating what an agent can access from what it can do on its own. Grant the minimum permissions needed, then increase autonomy in stages: explain, recommend, ticket, and only later remediate. Security teams should require business context, environment awareness, and approval gates for higher-risk actions, especially in production or externally facing systems.

Technical breakdown

Why workflow-spanning agents break login-centric IAM

Login-centric IAM assumes the security-relevant event is authentication, then policy follows a relatively bounded session. Agentic systems behave differently: the task may begin with one identity, branch through multiple tools and services, and end in an action whose risk depends on the full chain. That means the control boundary moves from the login event to the workflow itself. Delegation, tool use and authorization context become part of the identity problem, not separate concerns. Read AI Agents vs Agentic AI.

Practical implication: Model authorization around the workflow path, not just the initial sign-in or token issuance.

Identity context, trust and provenance at decision time

Agentic authorization depends on more than an allow list. The system needs to know who the agent represents, what the data came from, whether consent exists, and whether the information is trustworthy enough for the intended action. That creates a context-rich decision model where identity, data governance and policy intersect. In practice, the decisive question is not whether access exists, but whether the present context justifies using it for this task. See the Agentic AI Security Guide.

Practical implication: Attach consent, provenance and trust signals to authorization decisions instead of treating them as separate governance records.

Authorization chains across agents, tools and APIs

Agent chains create a delegation problem that classic entitlement models do not fully express. A single action may depend on one agent invoking another, calling a tool and reaching an API before the final transaction occurs. Each hop can preserve, narrow or distort the original intent. That is why authorization context has to move with the request, or governance loses sight of why the action was permitted in the first place. See the Multi-Agent and A2A Security Guide.

Practical implication: Preserve delegation and intent metadata across every hop so downstream decisions remain attributable and reviewable.

NHI Mgmt Group analysis

Agentic AI turns IAM from a point control into a moving control surface: The older model assumes the identity event is the main event. That assumption fails when a task can traverse several tools, services and agents before the system acts. The implication is that identity governance now has to evaluate execution paths, not just subjects.

Context is now part of authorization, not a nice-to-have overlay: Purpose, consent, provenance and trust are no longer background data points. They decide whether an action is acceptable at the moment it is attempted. Enterprises that keep those signals outside the authorization plane will continue to approve actions they cannot truly explain.

Delegation chains create accountability gaps unless the context travels with the action: If a person starts the task but an agent or sub-agent completes it, the original intent can become detached from the resulting transaction. That is a governance failure, not just a logging gap. Practitioners need evidence that preserves who initiated, who acted and why the action was allowed.

Runtime authorization is the new control model for agentic systems: The named concept here is the runtime governance gap. It is the space between static entitlements and live decision-making, where agent behaviour changes too fast for traditional approval and review cycles. Security teams should treat that gap as the core design problem for agentic identity, not an implementation detail.

Access review cadences assume privileges persist long enough to be reviewed: That assumption weakens when an agent can obtain context, act and move on before a human review cycle ever reaches the event. The result is not just faster operations, but a weaker fit between governance process and machine-paced action. The practitioner conclusion is clear: review-only models do not close runtime risk.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Runtime decisioning will become the real control plane for agentic identity: A static entitlement model cannot keep pace when agents can gather context, call tools and act in one chained workflow. Governance programmes should expect the authorization boundary to move closer to execution time, where intent, provenance and trust are still visible.

69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That shift matters because access review and approval loops cannot govern machine-paced decisions once the action path is already in motion.

The practical consequence is a tighter link between identity governance, data governance and policy enforcement. Programmes that keep those functions separate will struggle to explain why an agent was allowed to act, even when the underlying identity was valid.

For practitioners

• Define workflow-level authorization boundaries Map the full agent path from user intent through tool calls, APIs and downstream actions, then decide where approval, policy checks and traceability must occur.
• Carry delegation context across every hop Preserve who initiated the task, what authority was delegated, and what policy context accompanied each decision so downstream actions stay attributable.
• Bind consent and provenance to authorization Require the runtime control plane to evaluate data sensitivity, source provenance and consent state before an agent can use information for a task.
• Separate static identity from live intent Treat authentication as necessary but insufficient, and add policy logic that checks whether the present task still matches the original purpose.

Key takeaways

• Agentic AI changes the governance problem from who signed in to how a multi-step workflow is authorised before it acts.
• The critical gap is runtime context, because purpose, consent, provenance and trust can determine whether the same identity should proceed.
• Security teams need controls that preserve delegation and intent across agent chains, or accountability will fragment across tools and sub-agents.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic AI Identity Maturity Model · Agentic AI Security Guide · Multi-Agent and A2A Security Guide

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Identity Knowledge Graph: A living model that links identities, workloads, entitlements and business actions into one navigable view. In machine identity programmes, it replaces static spreadsheets with continuously refreshed relationships so teams can see who owns an identity, what it can touch and how changes affect exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.