Agentic runtime governance needs identity, intent and data together

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WitnessAI's blog post: Agentic runtime governance fails when security checks stop at valid access and do not evaluate identity, intent and data together at the moment of action.

Why it matters: IAM, PAM and AI governance teams need to understand that tool approval alone does not decide whether an agent should be allowed to act with sensitive data in a given context.

Context

Agentic runtime governance is the problem of deciding whether a software agent should be allowed to take a specific action with a specific tool and a specific dataset at that moment. In this article, the core failure is not authentication, but the gap between permission and action in an AI agent workflow.

The identity governance connection is direct for agentic AI: the employee, the delegated task, the model activity and the data classification all influence the decision. Existing access controls can say who may start the workflow, but they do not by themselves decide whether the resulting tool call should complete.

Runtime decision gap: the article argues that governance has to operate during the action, not only before it starts. That matters because the risky event is not the request itself, but the attempt to move sensitive context through an external tool after the agent has already handled it.

Key questions

Q: What breaks when AI agent access is added through connectors instead of governed approvals?

A: The approval trail breaks first. Connector-based access can reuse existing identities or keys, so the expansion of privilege looks like a configuration change rather than a new access decision. That leaves auditors with no meaningful record of who approved the reach, and it makes least privilege hard to prove after deployment.

Q: Why do identity and access reviews struggle with agentic workflows?

A: Because the critical decision happens inside the session, not only at provisioning time. Traditional reviews assume access is stable long enough to be certified, but an agent can assemble context, plan a step and execute a tool call in the same workflow. Governance must therefore move to runtime rather than depend on later certification.

Q: How do security teams know if agent governance is actually working?

A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent. If any of those answers require manual reconstruction, governance exists on paper but not in operations.

Q: What is the difference between tool approval and action authorization for AI agents?

A: Tool approval says an agent may reach a service or interface. Action authorization says the specific use of that tool is acceptable in this task, with this data, for this purpose, right now. The distinction matters because a valid tool path can still carry an invalid or risky action through it.

Technical breakdown

Why valid credentials do not equal valid agent action

A credential proves that an identity is permitted to act within some boundary, but it does not prove that the action itself is safe in context. In agentic systems, the same runtime may combine a legitimate user request, a model-generated plan and an outbound tool call. That creates a decision problem that sits between identity, policy and data governance. ARISE, as described in the article, treats the control point as the live action itself, not just the login or the tool inventory. The technical issue is that authorization must be contextual, not static.

Practical implication: Design controls that evaluate the specific action, not just the identity or the tool list.

How identity, intent and data are combined at runtime

The article describes three signals that each answer a different question. Identity answers who is acting or who delegated the work. Intent answers why the request is happening, inferred from the interaction and task context. Data answers what is being touched, including whether sensitive material is involved. None of those signals alone can determine whether an outbound action is appropriate. In practice, the policy engine needs all three to decide whether to allow, block, redact, pause or step up the transaction before the action completes. That is the core mechanism behind agentic runtime governance.

Practical implication: Use a policy layer that can join identity, intent and information classification in one enforcement decision.

Why inline intervention matters for MCP and tool governance

Model Context Protocol is relevant here because it connects agents to tools and data sources, which means it also expands the surface where a policy decision must be made. If the decision arrives after the tool call completes, the enterprise is left with post-event remediation rather than prevention. The article’s baseline is inline enforcement, meaning the control point can interrupt the workflow before the data leaves the boundary. That is materially different from logging, alerting or later review, which may explain what happened but cannot stop the action that already occurred.

Practical implication: Place enforcement in the request path for MCP connections and outbound tool calls, not only in audit logs.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity approval is no longer sufficient when the control target is an action, not an account. The article shows that a valid credential, approved tool and permitted user role can still produce an invalid agentic action. That means the governance question has shifted from whether an identity may access a system to whether a specific runtime decision should be allowed to proceed. Practitioners should treat action authorization as a separate control plane.

ARISE captures a real governance gap: existing access models were built for pre-declared intent. The assumption underneath many IAM and access review processes is that purpose is stable enough to be inferred from the grant, role or workflow. In agentic systems, purpose can emerge and change inside the session as the model prepares and executes a tool call. The implication is that policy must be evaluated at runtime, when the action and context are visible.

Runtime governance is becoming the bridge between human accountability and machine-speed execution. The article’s strongest point is that the employee, the agent and the sensitive data are part of one decision chain. That makes agentic governance an identity problem, a data problem and a workflow problem at the same time. Security teams should expect governance failures whenever those three views live in separate systems.

Identity, intent and information is the right named concept for this market. The article’s analysis is not really about tool control alone; it is about correlating who or what is acting, why it is acting and what it is touching. That combination is becoming the practical boundary of agentic policy, and it is the right lens for buyer evaluation and architecture design.

Visibility without intervention remains a downstream control, not a runtime safeguard. The article is explicit that detection and alerting sit below the production baseline because they leave the enterprise dependent on after-the-fact cleanup. For practitioners, that means audit evidence is necessary but not sufficient, and the decisive question is whether the control can still change the outcome before completion.

What this signals

Identity, intent and information are becoming the practical boundary of agentic policy. Teams that still treat model access, data classification and workflow authorisation as separate programmes will keep missing the moment when an agent should be stopped. The governance model now has to decide at runtime, not just at enrolment or review.

Runtime intervention is the real line between governance and observability. Logs, alerts and review trails matter, but they do not prevent a sensitive transfer once the agent has already prepared it. Practitioners should measure whether their control plane can still change the outcome before the tool call completes.

For practitioners

• Define runtime authorization for agent actions Separate approval to initiate a task from approval for the agent to complete each outbound tool call, data transfer or external action.
• Bind policy to identity, intent and data Require the enforcement layer to evaluate the acting identity, the inferred purpose of the task and the sensitivity of the data before allowing completion.
• Move controls into the traffic path Inspect prompts, MCP connections and tool calls inline so the policy engine can block, redact, pause or step up a live action before it executes.
• Test governance against delegated workflows Validate whether your current controls still work when an employee delegates a sensitive task to an agent that can plan and act without a separate human check at each step.
• Reconcile audit evidence with action control Check that logs prove who acted, what data was touched and which decision was made, but do not mistake logging for the ability to stop the action.

Key takeaways

• Agentic governance fails when valid access is mistaken for valid action, because runtime context can make an otherwise approved workflow unsafe.
• The article’s central insight is that identity, intent and data must be evaluated together to decide whether an agent should proceed.
• Security teams need controls that can still block or reshape the action before completion, not just record what happened afterwards.

Key terms

• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Agentic Policy Enforcement: Agentic policy enforcement is the practice of applying access and action controls to an AI agent during execution, not only at setup time. It focuses on what the agent can do, which tools it can invoke, and when response should interrupt a risky sequence.
• Intent Signal: An intent signal is the observable indication of why an identity is acting, not just what it is allowed to do. In agent governance, it helps compare live behaviour with the task that authorised it, which is essential when static policy cannot judge context well enough.
• MCP governance: MCP governance is the set of policies, controls, and oversight used to manage how AI agents use the Model Context Protocol to reach tools and data. It defines approved connections, authentication, authorization, logging, data handling, and change control so agent actions remain traceable, bounded, and aligned with security and compliance requirements.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.