Agentic enterprise control planes are becoming an identity problem

At a glance

What this is: This is Island’s case for a control plane that governs AI agents across browser, endpoint, network, and identity surfaces, with the central finding that current governance misses how agents act rather than merely respond.

Why it matters: IAM, PAM, and NHI teams need to treat agent behaviour as an access problem because approval workflows, inventories, and audit trails built for humans or code do not capture autonomous tool use.

By the numbers:

• Island research puts 53% of AI interactions at autonomous actions rather than a person typing a question.
• A McKinsey survey found that 93% of respondents have reported exceeding their AI budgets.
• Island found 93% of prompts put in front of a human reviewer get approved.

👉 Read Island's analysis of the control plane for the agentic enterprise

Context

Agentic enterprise security is the problem of governing software that can read files, call tools, and take actions without a person approving each step. The article argues that existing security controls were built for humans or code, while agents now operate inside the same enterprise surfaces as employees.

For IAM and NHI programmes, the failure is structural: inventories, approval workflows, and audit models assume a stable operator and a predictable request path. Once the actor can decide which tool to call and when to execute it, governance has to follow the action chain rather than the login event.

The article is positioned as a vendor explanation of why browser, endpoint, network, and identity visibility must be joined for agent oversight. That framing is typical of a market now trying to map agentic AI into identity and access control language rather than inventing a separate discipline.

Key questions

Q: How should security teams govern AI agents that can choose tools at runtime?

A: Security teams should govern runtime agent choice as an access event, not as a simple application action. That means scoping permissions to the task, limiting token lifetime, logging every tool decision, and blocking the agent from reaching systems outside its approved context. Static roles alone are not enough when the execution path changes on each run.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when an agent has broad write access across business systems?

A: Broad write access turns a helpful agent into a platform-wide escalation path. If the same identity can create records, modify workflows, and touch sensitive data without separate policy checks, an attacker only needs one successful invocation to move from limited access to durable control.

Q: Who is accountable when an AI agent acts outside its intended scope?

A: The organisation is accountable, but operational responsibility should sit with a named owner and a governance process that can explain the agent’s purpose, access, and recorded actions. Without that, autonomous behaviour becomes unassignable risk rather than managed automation.

Technical breakdown

Why agentic AI breaks tool-based visibility

An agentic system does not just generate content. It can read a file, invoke a tool, retry a failed action, and continue until the task is complete. That creates a control problem because browser tools, endpoint tools, network tools, and identity tools each see only part of the sequence. When visibility is fragmented, an analyst can detect the file read or the external transfer but miss the decision path that connected them. The technical issue is not simply more telemetry. It is the need to correlate prompt, tool call, data access, and downstream action into one execution chain.

Practical implication: Practitioners should design detections and audit trails around chained agent actions, not isolated prompts or credentials.

How just-in-time credentials change agent identity governance

The article describes agents using non-human identities and receiving just-in-time credentials through an MCP gateway rather than holding standing keys. That matters because a standing credential creates long-lived access, while an agentic credential model should be task-scoped and time-bounded. In practice, the governance question is whether the agent receives a reusable identity or an ephemeral entitlement tied to a specific action path. This is a workload identity problem as much as an AI problem, because the controls governing issuance, scope, and revocation determine blast radius.

Practical implication: Teams should treat agent credentials as short-lived workload identities and review whether any standing access remains in the stack.

Why approval workflows fail for autonomous execution

The article’s human review model is weak because a reviewer can approve a prompt without understanding the full tool chain the agent will invoke. If the approval occurs before the action path unfolds, the control becomes symbolic rather than preventative. The deeper risk is that agents can operate in loops and move from prompt to tool call to data movement faster than a manual review cycle can react. This is where governance shifts from authorising messages to authorising runtime behaviour.

Practical implication: Security teams should replace prompt approval alone with runtime policy enforcement that can block tool calls and data movement in-session.

Threat narrative

Attacker objective: The objective is to hijack or misuse agent-driven access so that trusted non-human actions move data, invoke tools, or trigger commands outside intended policy.

1. Entry occurs when an agent is granted access to enterprise systems through a browser session, endpoint context, or MCP-connected tool.
2. Escalation happens as the agent chains file access, tool calls, retries, and external transfers within one task flow that no single control plane fully sees.
3. Impact is data exposure, unauthorised action, or rogue execution that becomes visible only after the agent has already completed the sequence.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic enterprise governance is now an identity control problem, not an AI policy add-on. The article shows agents running inside the same work surfaces as employees, which means identity, privilege, and audit must follow runtime behaviour instead of user intent. Once an actor can call tools and continue executing without a human approval gate, traditional access review logic no longer describes the risk. The practitioner conclusion is that agent governance belongs inside IAM and PAM architecture, not beside it.

Approval workflows are not a substitute for runtime authorisation. If 93% of reviewed prompts are approved, the review step is functioning as a rubber stamp, not a policy control. The agent still decides how to reach the outcome, which means the real control point is whether the tool call, data access, or sub-agent handoff is allowed in-session. The implication is that governance must move from pre-execution endorsement to enforcement at the moment of action.

Identity blast radius now depends on what an agent can chain, not just what it can log into. A single agent identity may touch browser sessions, local files, APIs, MCP servers, and sub-agents in one task. That creates a governance surface larger than conventional service account review because the same identity can traverse multiple control domains without a human operator in between. Practitioners should treat chained tool use as the core containment problem.

Agents inherit the weakest parts of the enterprise supply chain around them. The article’s MCP discussion shows that unverified external servers, extension sprawl, and ad hoc connections can become part of the execution path. That is a non-human identity governance issue because the agent is only as trustworthy as the credentials, tools, and connected services it can reach. The field should stop treating agent security as a point product and start treating it as ecosystem governance.

Standing privilege assumptions collapse when the worker is an agent. Least privilege was designed for identities whose access needs can be understood at provisioning time and reviewed later. That assumption fails when the actor is autonomous because the exact tool path is chosen at runtime and may change mid-session. The implication is that access programmes must be redesigned around ephemeral, bounded execution rather than persistent entitlements.

From our research:

• 33% of organisations report their AI agents have accessed inappropriate or sensitive data beyond their intended scope, according to AI Agents: The New Attack Surface report.
• 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• Ultimate Guide to NHIs , 2025 Outlook and Predictions frames how agentic access is changing NHI governance priorities.

What this signals

Agentic AI changes the control objective from validating requests to containing runtime behaviour. If your programme still depends on human review, the bottleneck is already too late in the chain, because the agent has usually selected tools, accessed data, and created evidence before the reviewer acts.

Identity blast radius: the practical limit of what one agent identity can touch before the session becomes an investigation problem. This is now a governance metric, not just a technical one, and teams should measure it across browser, endpoint, and connected tool surfaces.

As the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework mature, practitioners should expect policy language to converge around tool misuse, agent identity, and runtime enforcement. The organisations that standardise these controls early will spend less time retrofitting auditability after the first agent incident.

For practitioners

• Map every agent to a named non-human identity Inventory which browser sessions, endpoints, MCP servers, and internal APIs each agent can reach, then bind those paths to a specific identity record and owner. Without that mapping, audit trails will show activity but not accountable execution.
• Replace prompt review with runtime policy enforcement Block or allow tool calls, file access, and sub-agent handoffs in-session rather than relying on human approval of the original prompt. The control needs to interrupt the action chain, not just record it after the fact.
• Issue just-in-time credentials for every agent task Remove standing keys from agent workflows and scope each credential to a single task or bounded session. Revoke access automatically when the action completes or the session ends.
• Correlate browser, endpoint, network, and identity telemetry Build detection rules that join prompt origin, tool invocation, file read, and outbound transfer into one sequence so analysts can see the full chain. Partial telemetry will continue to miss agent-driven misuse.

Key takeaways

• AI agents are no longer a peripheral chatbot issue. They are a runtime identity and access problem that existing governance models do not fully cover.
• Review-only controls are too weak for autonomous execution because the agent can complete the action chain before approval adds any real protection.
• The right response is to govern agent identity, tool access, and session scope together so blast radius stays bounded.

Key terms

• Agentic enterprise: An operating model where humans and autonomous AI systems work together inside the same business workflows. The security challenge is that decisions, data movement, and access all happen at machine speed, so governance must track both the actor and the workflow context.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.

What's in the full article

Island's full blog covers the operational detail this post intentionally leaves for the source:

• How the control plane maps across browser, endpoint, network, and identity surfaces in live enterprise workflows
• How the vendor groups agentic endpoint posture, agentic identity, AI protect, and cost controls into one policy engine
• How the audit trail is positioned for SOC 2, ISO 27001, and EU AI Act conformance
• How the product treats MCP servers, skills, packages, and extensions as governed agent inputs

👉 Island's full blog explains the policy engine, audit trail, and runtime controls for agent activity across enterprise surfaces.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.