Agentic AI vs generative AI: why identity controls must change

At a glance

What this is: This is a Descope analysis of how agentic AI extends generative AI by using model output to drive tool calls and multi-step actions, and why that shifts the identity control problem from static prompting to runtime authorization.

Why it matters: It matters because IAM, PAM, and NHI programmes built for human-paced review can miss agentic workflows that request, combine, and act on access inside a single session.

By the numbers:

• Agentic AI is already used or planned by 88% of organisations, according to Descope’s 2025 State of Customer Identity survey.

Context

Generative AI and agentic AI are often discussed together, but they create different identity problems. Generative systems produce content in response to a prompt, while agentic systems use model output to decide what to do next, which means access control has to cover tool use, action sequencing, and delegated execution.

The governance gap is not whether a model can generate text. It is whether identity controls can govern a system that turns generation into orchestration across APIs, workflows, and enterprise tools. That distinction matters for NHI, agentic AI, and the access boundaries that sit around both.

Descope’s article uses that distinction to argue that AI programmes should not treat all AI the same way. The practical question is how far existing IAM assumptions still hold once a model can trigger chained actions rather than stop at a single answer.

Key questions

Q: What breaks when AI agents and humans share the same access model?

A: When AI agents and humans share the same access model, organisations lose clean attribution, stronger approval boundaries, and reliable review evidence. The access may be technically valid, but the governance model cannot say who initiated the action with enough confidence. That weakens incident response, recertification, and accountability.

Q: Why do agentic AI systems change IAM risk?

A: They change risk because they can move from observation to execution. That means the control problem shifts from whether a system can detect a problem to whether it can safely act on one. IAM teams must now manage privilege scope, action boundaries, and revocation for autonomous workflows.

Q: How should security teams govern AI agents that choose tools at runtime?

A: Security teams should treat runtime tool choice as a governed access event, not a normal application call. That means task-scoped credentials, explicit approval boundaries for sensitive actions, and logs that record both the tool selected and the identity used. If the agent can change its plan, the control model must be able to change with it.

Q: What is the difference between agentic AI and generative AI in application security workflows?

A: Generative AI produces outputs such as text, summaries, or recommendations, while agentic AI is designed to act autonomously toward a goal. In AppSec, that means agentic systems can detect, prioritize, and help remediate issues across the SDLC with less manual intervention. The distinction matters because security teams need workflow execution, not just content generation.

Technical breakdown

How generative AI differs from agentic orchestration

Generative AI is prompt-in, output-out. Agentic AI adds scaffolding so the same underlying model can plan, choose tools, and continue through multiple steps until a goal is met. In technical terms, the model is still generating text, but that output is parsed into actions, which creates a workflow that looks like autonomy even when it is still bounded by policy and system design. The security issue is that the identity boundary shifts from one response to a sequence of tool interactions.

Practical implication: Treat every tool call as an authorisation event, not just the final user request.

Why session-scoped access changes the control model

Agentic systems do not behave like static accounts with a predictable access pattern. They request access, use it, and may move on to another tool or system in the same session, which makes traditional review cadence a poor fit. The control problem becomes one of runtime issuance and scope, not after-the-fact attestation. This is why identity controls must be evaluated at the point of action rather than only at provisioning time.

Practical implication: Move authorisation decisions closer to execution and constrain the scope of each issued privilege.

Why MCP and A2A raise the governance bar

Protocols such as MCP standardise how agents connect to tools, while agent-to-agent patterns expand coordination across systems. That increases interoperability, but it also expands the number of identity boundaries that must be governed, logged, and revoked. Once an agent can call external tools or interact with other agents, the problem is no longer just model safety. It becomes delegated access governance across a growing execution graph.

Practical implication: Map every connected tool and peer agent to an explicit identity and policy boundary.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI is not a new model category so much as a new identity problem. The article is right to separate creation from orchestration, because the risk changes once outputs become actions. That shift pulls AI systems out of a prompt-only security model and into runtime access governance, where every tool call is an access decision. For IAM teams, the material question is not what the model can say, but what it can cause to happen.

Access review assumptions collapse when the actor can request and discard privileges within one session. Access reviews were designed for privileges that persist long enough to be observed and certified. When an AI system can chain steps, invoke tools, and complete a task before a review cycle even has a signal, the control is no longer late, it is misfit. The implication is that governance must move to issuance time and session boundary enforcement.

Agentic AI inherits NHI governance constraints but exceeds their comfort zone. Agentic systems still rely on non-human identities, secrets, and delegated authentication, so OWASP-NHI and Zero Trust thinking remain relevant. But once tool use becomes conditional on model-generated decisions, the control stack has to account for decision drift, scope expansion, and chained privilege use. The field should treat this as an NHI-plus problem, not a generic AI awareness issue.

Model Context Protocol makes identity governance more, not less, important. Standardised agent-to-tool connectivity improves interoperability, but it also creates a repeatable path for privilege exposure if identity, authorisation, and audit boundaries are weak. That means protocol adoption should be paired with explicit control mapping, not treated as an integration shortcut. Practitioners should assume that each new tool connection expands the blast radius unless governed as a discrete identity relationship.

Named concept, orchestration boundary debt: agentic systems accumulate governance debt when each new tool connection is approved individually but never revalidated as part of the full execution chain. The risk is not one bad permission; it is the compound effect of many apparently reasonable permissions acting together. Practitioners need to evaluate the whole orchestration path, not just each isolated entitlement.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Governance programmes built around review cycles should assume that some AI systems now act faster than certification workflows can observe. When the system can chain tool use inside one task, the practical control point moves from periodic review to delegated access issuance.

Orchestration boundary debt: every new agent connection adds another identity boundary that must be explicitly owned, revoked, and logged. Without that discipline, interoperability becomes an accumulation of ungoverned paths rather than a controlled operating model.

For practitioners

• Define a runtime authorisation boundary for agents Treat every agent-initiated tool call as a separate access decision with explicit scope, context, and expiration. Do not rely on the original user prompt as proof of ongoing intent.
• Inventory agent-connected tools and APIs List every external system an agent can reach, then assign an owner, purpose, and revocation path for each connection. Hidden or unowned connections are governance gaps, not integration details.
• Separate generation from execution privileges Allow a model to draft, classify, or recommend without giving it the same access to perform the action. Distinguish content generation rights from workflow execution rights in policy.
• Shorten the lifespan of delegated access Use task-scoped credentials and revoke them when the session or workflow closes. The goal is to prevent agents from carrying reusable privilege across unrelated actions.
• Log the full orchestration path Capture which tool was called, what policy allowed it, and which downstream action followed. Without that chain, you cannot reconstruct whether the agent stayed inside its intended boundary.

Key takeaways

• Agentic AI changes the problem from content generation to delegated execution, which makes identity and access governance part of the model’s runtime behaviour.
• The article’s central warning is that review-based controls lag systems that can request and use access within a single workflow.
• Practitioners should govern agent tool use as a discrete identity relationship, with tighter scope, shorter lifespan, and stronger logging.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Generative AI: AI designed to create text, code, images, or other content in response to a prompt. It is usually reactive rather than autonomous, which means the main security concern is output quality, leakage, and misuse of generated content rather than independent action.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.