Agentic software factories need stronger identity and utility controls

At a glance

What this is: This is a practitioner analysis of the agentic software factory model and its key finding that the real governance problem sits in the utilities layer, not the agents alone.

Why it matters: It matters because IAM, PAM, and NHI controls must now cover model access, credential custody, tool mediation, and evidence capture across autonomous delivery workflows.

By the numbers:

• In the first half of 2026, some organizations operating the agentic software factory model described productivity gains of 3 to 5 times.
• Spotify reports more than 1,500 agent-generated pull requests merged into production.
• 60% to 90% time savings in the studied

👉 Read TruFoundry’s analysis of the agentic software factory and enterprise controls

Context

Agentic software factories treat software delivery as a production system, with coding agents performing more of the work inside a structured pipeline. The identity question is not whether the agents are intelligent, but which credentials, approvals, and control points govern the system that lets them act.

For IAM and NHI teams, the interesting shift is the utilities layer: model supply, credential handling, quality controls, telemetry, and spend metering. Those controls now sit between intent and execution, which means access governance has to cover both the agent runtime and the mediated infrastructure it uses.

The article’s core claim is that factories fail when controls are bolted only around the pipeline or the agent, while bypass paths, downstream systems, and shared credentials remain outside governance. That is a typical failure mode in early-stage agent deployments, especially where speed is treated as the primary design goal.

Key questions

Q: How should security teams govern AI-generated code in production pipelines?

A: Security teams should treat AI-generated code as a controlled identity event, not just a development artifact. Require human approval, traceable authorship, scoped workload identities, and evidence of intent before production promotion. The goal is to preserve provenance and limit blast radius when generated logic behaves unexpectedly.

Q: Why do agentic software factories increase identity risk?

A: They compress more decision-making into a shorter execution window, which expands the potential blast radius of every credential and tool invocation. That matters because identity controls built for human-paced review often assume time for inspection, challenge, and rollback. When automation is mediated poorly, speed becomes exposure.

Q: What do teams get wrong about MCP gateways and agent governance?

A: They assume a gateway covers the whole factory. In reality, it only governs participating traffic, while direct APIs, browsers, shells, CI systems, and downstream services still need their own controls. Good governance starts by proving which paths are mediated and which are not.

Q: What should organisations review before expanding agentic delivery?

A: Review model access, credential custody, intermediate quality checks, traceability, cost controls, and human authorization in proportion to what the system can access and change. If those controls are uneven, scale amplifies both defect rate and security impact instead of reducing them.

Technical breakdown

What the utilities layer controls in an agentic software factory

The utilities layer is the mediated infrastructure that makes agentic delivery governable: model routing, credential injection, guardrails, traces, budgets, and evidence capture. In this model, the agent is not the control plane. The control plane is the system that decides which tools it can reach, what identity it presents, what operations are logged, and when human approval is required. Without that layer, the factory becomes a collection of autonomous actions with no consistent policy boundary.

Practical implication: separate agent capability from the infrastructure that authorises and observes it.

Why MCP gateways change identity control points

Model Context Protocol creates a standard way for agents to reach tools and data sources, but standardisation does not equal trust. Once an MCP gateway mediates those calls, identity decisions move from ad hoc application integrations into a shared boundary where registration, authentication, authorisation, and observability can be enforced. The security challenge is that any direct API, browser action, shell command, or CI path outside that gateway still needs its own controls, or the gateway becomes only partial coverage.

Practical implication: treat the gateway as one enforcement point, not the whole security model.

Why agentic delivery needs evidence, not just automation

Agentic software factories produce side effects faster than manual review cycles can absorb. That creates a governance need for traces, request records, policy decisions, and downstream evidence that survive the workflow. Telemetry is not just for troubleshooting. It is the audit layer that lets security, engineering, and compliance teams reconstruct who or what acted, under which identity, and with what authority. Without evidence, approval becomes ceremonial and remediation becomes guesswork.

Practical implication: require immutable evidence streams for every agent action that can change code, data, or permissions.

Threat narrative

Attacker objective: The objective is to convert governed delivery tooling into a high-speed execution path for unauthorized or unsafe changes.

1. Entry occurs when an agent receives mediated access to models, tools, or repositories through a gateway or similar control boundary.
2. Escalation occurs if credentials, downstream APIs, or bypass paths let the agent reach systems that were never intended to be part of the governed factory.
3. Impact occurs when unreviewed agent actions create code changes, data changes, or operational side effects faster than humans can verify or roll back them.

Breaches seen in the wild

• Amazon Q AI Coding Agent Compromised — Amazon Q AI coding agent compromised via prompt injection enabling hackers to inject data-wiping commands.
• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The utilities layer, not the agent model, is the real governance boundary. Agentic software factories fail when teams focus on the worker and ignore the mediated infrastructure that hands out access, logs actions, and enforces limits. In identity terms, model routing, credential custody, and tool mediation are the equivalent of power, plumbing, and metering in a physical plant. Practitioners should govern the layer that grants and records authority, not the model that consumes it.

Shared control planes do not remove the need for local enforcement. A gateway can centralize authentication, authorization, guardrails, and observability for participating tools, but direct APIs, browser actions, shell access, CI systems, and downstream services remain separate risk surfaces. That is a familiar NHI pattern: one mediated identity path rarely covers the whole execution chain. Teams should assume bypass paths exist until proven otherwise and govern them explicitly.

Agentic delivery exposes a new identity blast radius. When one agent can move from code generation to repository changes, CI actions, and downstream system effects, the blast radius is no longer bounded by a single tool session. The named concept here is identity blast radius: the total scope of change an identity can cause before human review intervenes. Practitioners should use that concept to judge whether the factory design is safely bounded or operationally overextended.

Credential handling is the decisive control, because agents cannot be trusted with embedded secrets. The article’s own architecture points to centralized credential injection, user-specific OAuth where supported, and managed access for registered servers as the core trust mechanisms. That mirrors a broader NHI governance truth: if credentials are distributed into agent definitions or bypass paths, the factory ceases to be governable. Teams should measure where secrets live, who can rotate them, and whether the agent can ever see them in raw form.

Evidence capture must be treated as a security control, not an observability afterthought. Trace records, request logs, and gateway policy outcomes are what let security teams distinguish approved automation from unapproved side effects. Without them, every investigation turns into reconstruction from partial logs and downstream symptoms. Practitioners should make evidence retention part of the factory design, because speed without attributable evidence is operational debt.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, which leaves 48% with a compliance and investigation blind spot.
• The next step is to pair agent governance with the OWASP Agentic AI Top 10 so tool misuse, scope drift, and identity abuse are assessed before scale expands further.

What this signals

Agentic software factories will push identity teams toward boundary-based governance rather than account-based governance. The practical test is no longer whether an agent can act, but whether every action is mediated, attributable, and reversible across the whole delivery chain.

Identity blast radius: this is the right lens for agentic delivery because it measures how far a single credentialed action can propagate before human review. As that radius grows, teams need to rethink approval design, trace retention, and downstream containment together.

For practitioners, the immediate signal is that shared gateways, model routers, and telemetry layers should be evaluated alongside repository and CI controls. The control model has to cover both the mediated path and the bypass path, or the programme will undercount its real exposure.

For practitioners

• Map every access path before scaling agents Inventory mediated paths, direct APIs, browser access, shell operations, CI jobs, and downstream system calls. Then assign an owner and a control requirement to each path so gateway coverage is not mistaken for total coverage.
• Centralize credential custody for agent-facing tools Use managed credential injection or supported OAuth patterns instead of embedding secrets in agent definitions. Review whether any registered MCP server, repository hook, or downstream connector still depends on static secrets.
• Require approval gates for high-impact actions Separate low-risk retrieval from code changes, deployment steps, and data-altering actions. Human authorization should be mandatory before the agent can complete actions that change production state or expand privilege.
• Bind every agent action to durable evidence Retain traces, request records, and policy decisions long enough for security review, audit, and rollback analysis. If the action cannot be attributed after the fact, it is not sufficiently governed.

Key takeaways

• Agentic software factories shift the main security question from model capability to control boundary design.
• The strongest governance signal is not automation volume but whether access, evidence, and approval remain attributable end to end.
• Teams that scale agents without proving credential custody and bypass-path coverage will create faster delivery and larger blast radius at the same time.

Key terms

• Agentic Software Factory: A software delivery system that embeds AI agents into a repeatable production workflow. The factory includes the controls around the agents, such as access, evidence, quality gates, and metering, so output can be governed rather than merely accelerated.
• Utilities Layer: The mediated infrastructure beneath agent execution that provides model access, credential handling, telemetry, guardrails, and spend limits. It matters because it is where authority is granted, constrained, and audited, making it the practical control plane for agentic delivery.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Bypass Path: Any route an agent can use outside the governed control point, such as direct APIs, browser access, shell commands, CI jobs, or local tools. Bypass paths matter because they can undermine a gateway or policy layer if they are not independently controlled.

What's in the full article

TruFoundry's full article covers the operational detail this post intentionally leaves for the source:

• The full utilities-layer checklist for model supply, credential handling, quality control, telemetry, and spend metering.
• Architecture notes on MCP gateway mediation, including where centralised controls stop and bypass paths begin.
• Examples of enterprise controls to evaluate before scaling agentic delivery, such as traceability and authorisation gates.
• The article's detailed comparisons between software factories, loop engineering, and platform engineering.

👉 TruFoundry's full article covers the utilities layer, control boundaries, and governance checklist in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.