Agentic migration needs identity substrate controls, not more friction

At a glance

What this is: This is an argument that agentic adoption only stays governable when identity, permission, delegation, lifecycle, and revocation operate as one runtime control plane.

Why it matters: It matters because IAM, NHI, and PAM teams have to design for tool-call governance, not just login governance, if they want agents to move fast without creating unreviewable access paths.

By the numbers:

• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• Only 5.7% of organisations have full visibility into their service accounts.
• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.

👉 Read C1.ai's analysis of agentic security as an identity substrate

Context

Agentic migration shifts the identity problem from who a user is to what a runtime actor is allowed to do on behalf of someone else. That changes the control model for IAM, NHI governance, and PAM because the risky event is no longer only authentication, but every tool call, delegation hop, and revocation point in the chain.

The article argues that security is not the brake on agentic adoption when the substrate is built correctly. In practice, that means identity-aware controls have to move from periodic review and broad entitlements to runtime authorisation, scoped delegation, and immediate revocation for AI-driven actions.

For identity teams, the interesting part is not the rhetoric about speed, but the operational claim that the safe path and the fast path can converge. That is atypical only if an organisation still treats agent credentials like static infrastructure secrets rather than governed, revocable identities.

Key questions

Q: How should security teams govern agent tool calls in production?

A: Treat each tool invocation as a separate identity decision, not as a one-time permission granted to the agent. The control model should validate current context, the specific tool being called, and whether the action matches the intended task. This is the only way to keep delegated agent activity auditable and bounded.

Q: Why do autonomous agents require different access governance than human users?

A: Human IAM assumes a stable user session and a predictable review cycle. Autonomous agents can request, combine, and use permissions inside a short runtime window, so lifecycle, delegation, and revocation have to operate continuously. The risk is not just overpermission, but permission being used before any human review can occur.

Q: What breaks when agent credentials are stored only in the runtime environment?

A: Long-lived secrets become available to any tool path, prompt leak, or misconfigured connector that can reach the runtime. A credential broker pattern reduces that exposure by keeping raw secrets in a vault and exchanging them only when policy approves the request. The key failure is uncontrolled secret persistence, not just weak storage.

Q: How do organisations know if agent governance is actually working?

A: Agent governance is working when every agent is discoverable, owned, least privileged, and auditable at the action level. Look for reduced shadow AI, fewer embedded secrets, clean revocation on retirement, and logs that show which tools and data paths were used. If those signals are missing, governance is still partial.

Technical breakdown

Identity-aware proxying for every agent tool call

An identity-aware proxy sits between the agent and the target tool so every action is authenticated, authorised, and logged at runtime. This is different from IdP-only checks because the decision happens at the moment of use, not just at session start. The model is closer to policy enforcement for non-human identities than to traditional human SSO because the object being governed is an action, not a login event. That makes the proxy the control point for delegation, scope, and traceability across chained actions.

Practical implication: Place policy enforcement at the call boundary so every tool invocation has a runtime access decision and audit trail.

Credential vaulting and auto-rotation for agent credentials

Credential vaulting keeps service credentials out of user laptops, source files, and environment variables, then pairs them with rotation and instant revocation. In agentic systems, credential exposure is not a theoretical hygiene issue because the agent may fetch, pass, or reuse secrets repeatedly across workflows. The article’s point is that the credential itself must be treated as a governed runtime object, not a static setup artefact. That is the same structural problem NHI programmes face with service accounts, API keys, and tokens, just at higher speed.

Practical implication: Remove long-lived credentials from local and pipeline storage, and make rotation plus revoke the default lifecycle state.

Scope minimisation and one-human accountability

Scope minimisation means the agent receives only the permissions required for the current task, while one human remains accountable for the entire chain. That combination matters because agent chains can cross multiple identities and execution steps without a natural break in responsibility. The article treats accountability as an operational invariant, not a governance slogan, because without a responsible human, the chain becomes hard to certify, limit, or shut down cleanly. This is where agency governance diverges from human IAM: the permission boundary must be defined for the task, while the responsibility boundary remains human.

Practical implication: Bind each agent chain to a named human owner and issue task-scoped permissions that expire with the job.

Threat narrative

Attacker objective: The objective is to turn delegated agent access into durable operational reach that can be used faster than human review can contain it.

1. Entry occurs when an agent or its delegated credential reaches a tool, secret, or dataset through a governed access path that was meant to be temporary but is still usable at runtime.
2. Escalation occurs when the agent chain inherits broader permissions than the immediate task requires, allowing additional calls, deeper delegation, or access to higher-value systems.
3. Impact occurs when the chain can act fast enough to complete work, touch production assets, or expose secrets before a human can reassert control.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agency has become the security object, not identity alone. The article is right to separate who something is from what it may do on whose behalf, because agentic systems turn access into a runtime problem. Traditional IAM answers the login question; agentic governance has to answer delegation, scope, lifecycle, and revocation at the moment of action. Practitioners should treat agency as the unit of control.

One-human accountability is the only stable control anchor in agent chains. The article’s insistence on a human at the top of every chain is not a policy preference, it is what makes authorisation and incident ownership tractable. Once an agent can spawn sub-agents or delegated actions, shared responsibility becomes a gap, not a safeguard. Security teams should design for named ownership across every chain hop.

Credential vaulting alone is not enough without runtime authorisation. Moving secrets out of laptops reduces exposure, but it does not solve the deeper question of when an agent should be allowed to use them. The article correctly ties vaulting to identity-aware proxying and instant revocation. Practitioners should see this as a control stack, not a single product capability.

Scope minimisation changes from a provisioning rule to a session boundary. Human IAM can tolerate broader entitlements because usage is slower and reviewable. Agentic runtime decisions compress that window, so least privilege has to be enforced at the moment of tool call rather than assumed from a role. The implication is that privilege design must be task-scoped, not role-scoped, for autonomous execution.

Runtime revocation is the named concept that separates governable agents from unmanaged automation. If a chain, credential, or delegated action cannot be stopped in one step, the organisation has not achieved agent governance. The article makes clear that shutdown speed is part of the control surface. Practitioners should measure whether revocation is truly immediate across the full delegation chain.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 71% of NHIs are not rotated within recommended time frames, showing how quickly runtime governance can decay when lifecycle controls are weak.
• For a broader lifecycle lens, Ultimate Guide to NHIs maps visibility, rotation, and offboarding to the control problems agentic programmes now inherit.

What this signals

Runtime authority is becoming the practical boundary for identity programmes. As agentic systems move from pilots to production, the old split between authentication and authorisation will not hold at the pace modern workflows require. Identity teams will need to prove that call-level enforcement, owner attribution, and immediate revocation exist before agents are allowed into business-critical flows.

Only 5.7% of organisations have full visibility into their service accounts. That number matters because agentic systems often inherit the same blind spots that already exist in NHI estates, only with faster execution and more delegation hops. Organisations that cannot inventory service accounts cleanly will struggle even more to govern agent chains and their credentials.

Runtime revocation will define the next maturity step in NHI and agentic AI governance. If shutdown depends on manual stitching across logs or waiting for a ticket queue, the control model is already behind the threat model. The next programme milestone is not just better inventory, but provable stop power across the full delegation chain.

For practitioners

• Implement runtime policy enforcement at the tool boundary Require every agent action to pass through an identity-aware proxy so authentication, authorisation, and logging happen on each call, not only at login or provisioning.
• Remove long-lived credentials from agent execution paths Keep service credentials in a vault, ban .env storage for agent workflows, and ensure rotation and instant revoke are available before any production rollout.
• Bind every agent chain to a named human owner Record a responsible human for each agent workflow, including chained sub-agent actions, so accountability remains traceable across delegation hops.
• Enforce task-scoped permissions for each agent session Issue the minimum access needed for the specific job and expire it with the task rather than relying on broad standing roles.
• Test revocation as a live operational control Simulate shutting down an agent, a delegated chain, and the associated credential from a single control point to verify that access ends immediately.

Key takeaways

• The article’s core claim is that agentic speed only works when identity controls move to runtime, where each tool call is authenticated, scoped, logged, and revocable.
• The biggest governance risk is not agent autonomy by itself, but delegated access that outlives task scope, human ownership, or the ability to shut it down quickly.
• Identity teams should measure governability by call-level control, task-scoped privilege, and one-step revocation across the full agent chain.

Key terms

• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
• Identity-aware Proxy: An identity-aware proxy combines routing with authentication and authorization logic. It checks tokens or certificates, applies policy at the edge, and forwards verified identity context to the backend so applications do not have to re-implement security decisions inconsistently.
• Immediate revocation: Immediate revocation means a credential stops working as soon as the system marks it invalid. For machine identities, this matters because any delay creates a residual exposure window, which can be enough for continued abuse after access should have ended.
• Agency: Agency is what an identity is allowed to do, on whose behalf, with what scope, and for how long. For autonomous or semi-autonomous systems, this is more important than login status because the control problem is about delegated action, not mere authentication.

What's in the full article

C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:

• The full runtime substrate model for identity-aware proxying across agent tool calls.
• The operational logic behind credential vaulting, auto-rotation, and instant revoke.
• The chain-of-accountability example showing one human owner across multiple agent hops.
• The 90-day blueprint referenced at the end of the series for teams planning rollout sequencing.

👉 The full C1.ai post covers the agent chain model, revocation mechanics, and the operational substrate in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.