Agentic security in practice raises new identity governance questions

At a glance

What this is: Cyberhaven shows how autonomous security agents are moving from assistance into direct execution across triage, threat modelling and IT support, while traditional identity governance assumptions lag behind.

Why it matters: IAM, PAM and NHI teams need to treat agentic systems as governed identities, because runtime action, third-party access and delegated decision-making change how privilege is granted, reviewed and revoked.

By the numbers:

• Security teams face a 200:1 ratio of engineers to AppSec professionals, according to Cyberhaven.
• Manual triage consumes up to 40% of a security engineer's week, according to Cyberhaven.

Context

Agentic security means software can reason about a task, select actions and execute them without waiting for a person at every step. In identity terms, that moves the control problem from static access assignment to runtime authority, delegation and revocation.

Cyberhaven's whitepaper describes three autonomous agents inside security and IT operations, each acting across systems that already carry business privilege. That matters because the governance question is no longer whether a tool is useful, but whether it is operating as a governed identity with bounded authority.

The article sits in a now-common enterprise pattern: organisations are adopting agentic systems faster than they can define who owns their privileges, how their actions are audited and what level of independence is acceptable.

Key questions

Q: What breaks when autonomous agents are governed like human users?

A: Session-based IAM breaks first, because autonomous agents can make and execute decisions between review points. That creates identity debt, weak forensic trails, and stale access that outlives the work it was meant to support. Teams need governance that binds identity to action and ownership continuously, not only at login.

Q: Why do autonomous agents increase identity governance risk even when they improve efficiency?

A: They increase risk because they compress decision, execution and privilege use into one machine-driven flow. That shortens the window in which humans can inspect intent, makes accountability harder to assign and raises the cost of any authorisation mistake that reaches a third-party system.

Q: What signals show that an agentic security programme is losing control of runtime authority?

A: Warning signs include agents acting across more systems than originally approved, unexplained direct changes in production tools, weak logs for model-to-action handoff and unclear ownership for revocation. If the team cannot reconstruct who authorised what, the programme has lost governance visibility.

Q: How should organizations approach the governance of AI agents?

A: Organizations should adopt a governance framework that incorporates continuous visibility, adaptive IAM practices, and stringent policy-based controls. This ensures that all agent actions are tracked, authorized appropriately, and assessed for compliance.

Technical breakdown

Why autonomous agents break traditional access review assumptions

Access review processes assume privileges remain stable long enough to be observed, certified and removed on a human governance cycle. Autonomous agents do not fit that pattern when they can acquire context, invoke tools and complete a task inside one session. In practice, the identity boundary shifts from named user accounts to runtime authority, where the real question is not who the agent is, but what it was allowed to do at the moment it acted. That is why agentic security is not just a stronger automation layer. It is a different governance model with a shorter decision loop and a larger need for scoped delegation.

Practical implication: Practitioners should govern agent privilege at issuance and session start, not rely on periodic access reviews alone.

How multi-model triage changes trust and accountability

Cyberhaven's vulnerability triage agent cross-checks findings from multiple foundation models before a judge model issues the final verdict. Architecturally, that reduces dependence on a single model output, but it also creates a layered decision chain where the human operator may not directly see each intermediate reasoning step. For identity teams, that matters because accountability no longer sits with one person, one model or one system. It sits across a chained workflow that includes model outputs, orchestration logic and the permission set behind the agent. The control problem becomes traceability of delegated judgement, not just accuracy of classification.

Practical implication: Require audit trails that show which model outputs informed each automated decision and which permissions enabled execution.

Why direct third-party action raises the bar for agent authorisation

Jarvis acts directly in Okta and other third-party systems, which makes authorisation the central control point. When an agent can resolve tickets without human intervention, it is not merely reading data. It is exercising delegated authority in external systems that may have their own privilege models, approval rules and logging gaps. That creates a governance problem across domains: the agent's own identity, the target application's permissions and the lifecycle that ties both together. For security teams, agentic security must be treated as an authorisation and offboarding problem as much as an operations problem.

Practical implication: Constrain agent-to-system access with explicit scope, approved actions and revocation paths that work across external services.

Threat narrative

Attacker objective: The objective is to abuse delegated agent authority to make trusted systems act outside human intent, creating fast, hard-to-audit operational impact.

1. Entry occurs when an autonomous agent is granted delegated access into operational systems such as ticketing, identity and cloud-adjacent services.
2. Escalation occurs when the agent can select actions independently and move from analysis into direct execution without a human approval gate for each step.
3. Impact occurs when those actions change production state, close tickets or alter security outcomes at machine speed across third-party systems.

Breaches seen in the wild

• Cyberhaven Chrome extension breach 2024: A phished OAuth consent gave attackers Chrome Web Store publishing rights and a malicious Cyberhaven extension update reached about 400,000 users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Autonomous security agents create an assumption collapse in identity governance. Access reviews were designed for privileges that persist long enough to be certified on a schedule. That assumption fails when an agent can request, use and discard authority within one runtime flow. The implication is not simply that reviews need to happen faster. It is that review-based governance no longer captures the moment when machine authority is actually exercised.

Runtime authority is now the real identity boundary for agentic security. The article shows agents moving from analysis to direct execution across vulnerability management and IT operations. Once an agent can act in third-party systems, the meaningful control is no longer the account label but the exact action envelope, approval condition and revocation path attached to that envelope. Practitioners need to treat these systems as governed identities, not as clever workflow tools.

Ephemeral privilege without auditability is governance debt: autonomous agents may reduce operational backlogs, but they also create a class of activity that cannot be understood through traditional joiner-mover-leaver logic. The better question is whether the organisation can reconstruct what authority the agent had, why it was granted and when it stopped. Identity programmes that cannot answer that will struggle to govern autonomous operations at scale.

Multi-model orchestration does not remove accountability, it redistributes it. Cross-checking outputs from multiple models may improve decision quality, but it also inserts more layers between a request and the resulting action. That makes model provenance, orchestration logs and delegated permissions part of the identity control plane. Security and IAM teams should expect agentic systems to be reviewed as composite identities with chained responsibility, not as standalone applications.

Agentic security is pushing PAM and IGA toward a shared control model. Direct actions in systems such as Okta show that privilege management for agents cannot be separated from lifecycle governance. If the agent can open, change and close operational tickets, then privilege scope, approval state and offboarding state become one control problem. The discipline that emerges is closer to identity governance for autonomous operators than conventional application integration.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Runtime delegation changes the control plane: when an agent can select actions and execute them in third-party systems, the security programme has to govern authorisation at the moment of use rather than at periodic review. That is why agentic security belongs in NHI, PAM and IGA conversations together, not in a separate innovation track.

Access review cadences assume a stable subject that can be certified after the fact. Autonomous systems may not preserve that stable state long enough for the review to matter, which shifts the programme toward scoped issuance, session logging and revocation.

The growth problem is already ahead of the governance model: only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey. The gap is not awareness, it is operational readiness.

For practitioners

• Define agent action envelopes List the exact operations each agent may perform, the systems it may touch and the conditions under which execution is allowed. Keep that scope narrower than the human workflow it replaces.
• Bind approvals to high-risk actions Require explicit approval gates for any action that changes identity state, security posture or third-party access, even if the agent can draft or recommend the change.
• Instrument end-to-end agent audit trails Log model outputs, tool calls, target systems, timestamps and final state changes so investigators can reconstruct delegated decisions after the fact.
• Treat agent offboarding as a governance event Revoke permissions, tokens and connectors together when an agent is retired, reassigned or found to have exceeded scope.

Key takeaways

• Autonomous security agents are no longer just assistants. They are acting as governed identities that can change state in external systems without a person in the loop.
• The core risk is not only model quality. It is the collapse of review-based governance when authority is exercised at runtime and then disappears.
• Identity and PAM teams need a control model built around delegated scope, auditability and revocation, because agentic operations turn authorisation into the primary security boundary.

Key terms

• Agentic security: The practice of governing software actors that can choose actions, tools, and timing in production workflows. It extends identity, authorization, logging, and lifecycle control to agents so their behaviour is tied to a verifiable principal and a revocable permission set.
• Action Envelope: An action envelope is the bounded set of operations an autonomous system is allowed to perform. In identity terms, it defines which systems, commands and state changes are permitted so that delegated authority stays narrow enough to govern and revoke.
• Runtime authority: Runtime authority is the permission an AI system has while it is actively deciding and acting, not just when it is approved. In governance terms, it is the point where access, tool use, and action scope become operational, which is why build-time review alone cannot prove safety.
• Delegated Decision Chain: A delegated decision chain is the sequence that turns a request into an action through one or more models, orchestrators and systems. It is important in agentic environments because accountability, logging and approval can be distributed across several components.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.