TL;DR: Agentic identity spans three distinct layers, discovery and posture, directory and lifecycle governance, and per-action proof, and no single product covers all of them, according to Scramble ID. The governance assumption that one control plane can both authorise and evidence autonomous actions is already breaking down as agent estates grow.
At a glance
What this is: This is an architectural analysis of agentic identity that argues the category has three distinct layers, each solving a different governance problem.
Why it matters: It matters because IAM, IGA, PAM, and NHI teams need to stop expecting one control plane to cover discovery, lifecycle, and evidentiary proof at the same time.
By the numbers:
- With Gartner expecting 40% of enterprise applications to ship task-specific AI agents by the end of 2026, most enterprises will need more than one layer of agentic identity control.
Context
Agentic identity is the governance problem created when software agents need registration, access scope, and auditability as first-class identity concerns. The article argues that buyers keep treating this as a vendor comparison when it is actually a layered architecture question.
The core gap is that discovery, lifecycle governance, and per-action proof answer different questions. One layer finds agents, another governs what they may do, and a third proves what actually happened when an agent acts on a customer, financial, or operational workflow.
Key questions
Q: What breaks when agentic identity is treated as one control plane?
A: Teams lose the ability to separate inventory, governance, and evidence. Discovery tells you what exists, lifecycle tells you what it may do, and per-action proof tells you what it actually did. When those are merged, ownership blurs and auditability weakens.
Q: Why are AI discovery tools not enough for agent governance?
A: Because discovery tells you what exists and how risky it looks, but it does not remove the credential that makes the action possible. A security team can still be left with standing OAuth grants, API keys, or connector secrets even after a platform identifies the agent as high risk.
Q: When should teams prioritise per-action proof over broader inventory work?
A: Prioritise proof when agents can approve, pay, file, or delete, because those actions create liabilities that need defensible evidence. If the business impact of an agent action is externalised, the evidentiary layer becomes the first control to strengthen.
Q: How should IAM teams divide responsibility for agentic identity controls?
A: Split responsibility by layer. One team can own discovery and posture, another can own directory and lifecycle governance, and a third can own cryptographic proof and audit verification. That structure prevents the common mistake of expecting one control to answer every identity question.
Technical breakdown
Why agent directories and lifecycle governance sit first
Directories answer who the agent is, who owns it, what it can access, and when that access expires. That is where registration, ownership, scoping, deprovisioning, and conditional access belong because they are identity lifecycle functions, not runtime evidence functions. In the article’s model, directory controls can onboard known agents, surface shadow agents, and keep agent identities from becoming orphaned. The architectural point is simple: if the identity is not governed at birth and death, nothing downstream can reliably recover that gap.
Practical implication: Treat agent registration and offboarding as a lifecycle control, not a tooling preference.
How discovery, posture, and detection differ from governance
Discovery and posture tooling answers a different question: what exists right now, what is risky, and what is behaving abnormally. These controls are about inventory, configuration, privilege scope, and runtime anomalies across agents, NHIs, and MCP-connected services. They reduce blind spots, but they do not by themselves establish authoritative ownership or evidentiary truth. The article is clear that discovery feeds the directory and helps triage exposure, but it does not replace lifecycle governance or cryptographic proof.
Practical implication: Use inventory and posture data to narrow exposure, then hand governed identities to a lifecycle control plane.
What per-action proof adds that logs alone do not
Per-action proof is the layer that ties a specific agent, under a specific authority, to a specific action in a way a verifier can check independently. That is more than logging. A log line can be altered, disputed, or detached from the authority that triggered the action; a cryptographic signature bound to the request is meant to be non-repudiable evidence. This layer matters most when agents approve, pay, delete, file, or otherwise create liabilities that outlive the session.
Practical implication: Require request-level evidence for consequential agent actions, not just retrospective audit logs.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic identity governance fails when organisations assume one control plane can cover discovery, lifecycle, and evidence. Those are separate obligations with different owners and different control goals. Discovery finds the estate, lifecycle governs the estate, and proof substantiates the estate’s actions. Practitioners should stop collapsing these into a single procurement question and treat them as distinct layers of control.
Per-action proof is the named concept that changes the category. A directory can tell you who an agent is and what it may do, but it cannot prove the action itself in a way an auditor or customer dispute can independently verify. That is why the article’s stack model matters: the evidentiary layer is not a feature of identity governance, it is a separate control plane. Teams that overlook that distinction will keep confusing authorization with non-repudiation.
Shadow agent discovery becomes operationally useful only when it feeds governed lifecycle controls. Inventory without ownership leaves organisations with more findings but not less risk. The article’s model is strongest when it treats discovery as a front end to governance, not a substitute for it. That is the right mental model for NHI, agentic AI, and wider IAM teams alike.
The market is moving toward composition, not consolidation, in agentic identity. The article’s three-layer framing shows why buyers will need to evaluate stack fit by function, not by logo. That will complicate procurement, but it also clarifies accountability across teams: one group owns discovery, another owns lifecycle, and another owns proof. Practitioners should expect architecture conversations to replace product-versus-product debates.
Agentic identity is forcing IAM teams to redraw the boundary between entitlement and evidence. In traditional identity programmes, proving access and proving action were often loosely coupled. For agentic systems, that gap becomes operationally visible and auditable. The implication is not just more controls, but a sharper separation of control objectives across the stack.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Per-action proof is the control that changes how agentic identity programmes should be built. Once agents can trigger business actions on their own, runtime evidence becomes a separate governance requirement from inventory and lifecycle. Teams that keep treating audit logs as sufficient will miss the point that the evidence has to travel with the action, not follow it later.
Agentic identity will likely split existing IAM work into three operating motions. Discovery and posture will look more like exposure management, directory governance will stay close to classic lifecycle controls, and proof will sit near high-consequence business workflows. That division means security architects should assign ownership before tool selection, not after it.
Per-action proof is the governance gap most programmes have not yet named. The difficult question is no longer only who the agent is or what it can access. It is whether the enterprise can independently verify that the action was taken under the right authority and with a non-repudiable record.
For practitioners
- Define the agentic identity stack by control function Separate discovery, lifecycle governance, and per-action proof in your programme design so each layer has one accountable owner and one clear job.
- Map shadow-agent discovery into your lifecycle workflow Route discovered agents, MCP servers, and unregistered identities into onboarding, ownership assignment, scoping, and deprovisioning decisions rather than leaving them as inventory findings.
- Require request-level evidence for consequential actions For approvals, payments, deletions, and filings, retain a cryptographic record that ties the agent, the authority, and the action together so the audit trail survives dispute.
- Review where long-lived secrets still underpin agent workflows Eliminate static credentials where possible so the governed identity, the action authority, and the evidentiary trail are not weakened by reusable secrets.
Key takeaways
- Agentic identity is emerging as a layered governance problem, not a single-platform purchase decision.
- Discovery, lifecycle control, and per-action proof solve different identity questions and cannot replace one another.
- Enterprises should align ownership, access scope, and evidentiary controls before agent volumes and liabilities grow further.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on governing agent identity, privilege, and proof across the stack. |
| Recommendation — Map agent identity controls to ASI03 and separate privilege governance from evidentiary proof. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Per-action proof depends on identity-bound authentication that cannot be faked by runtime logs alone. |
| NHI-05 — Overprivileged NHI | The directory and posture layers exist to prevent agent identities from carrying excess access. | |
| NHI-10 — Human Use of NHI | The article’s lifecycle layer depends on human ownership and accountability for non-human identities. | |
| Recommendation — Use NHI-04 to validate that each agent action is bound to a verifiable identity at request time. Apply NHI-05 to scope agent access to the minimum authority required for each workflow. Assign human ownership and review authority for every agent identity under NHI-10. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The stack separates who may act from what can be proven after the fact. |
| Recommendation — Use PR.AA-05 to govern agent entitlements before they reach execution. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | Long-lived secrets and consequential agent actions are the threat surfaces this architecture is meant to constrain. |
| Recommendation — Track agent credential exposure under TA0006 and high-consequence downstream effects under TA0040. | ||
Key terms
- Agentic stack: The agentic stack is the layer of tools, memory, orchestration logic, integrations, and policies surrounding an AI model. It is where a model gains the ability to take actions, reach data, and interact with systems, which is why many practical security failures happen above the model itself.
- Per-Action Proof: Per-action proof is cryptographic evidence attached to an individual agent action so the event can be verified independently. It goes beyond logging by preserving non-repudiation, which matters when the action has audit, legal, or financial consequences.
- Shadow Agent: An AI agent deployed without formal registration, identity governance, or security oversight, the agentic equivalent of shadow IT. Shadow agents are more dangerous than typical shadow NHIs because they actively take actions using their credentials.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 22, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org