TL;DR: AI agents need verified identity, defined scope, and continuous monitoring, but JumpCloud argues that most Agentic Zero Trust proposals collapse under platform complexity, fragmented tooling, and lean-team constraints. The real failure point is not the concept of control itself, but the assumption that governance can be rebuilt as a separate project rather than absorbed into existing identity operations.
At a glance
What this is: This is JumpCloud’s analysis of why Agentic Zero Trust for AI agents fails in practice when identity governance becomes too fragmented, complex, and expensive to operationalise.
Why it matters: It matters because IAM teams now have to govern AI agents alongside human and non-human identities, and complexity can become the real control failure even when the framework itself is sound.
Context
Agentic Zero Trust is the idea that AI agents should not be trusted by default, even when they are operating inside an enterprise environment. The governance problem is that the agent must have a verified identity, a defined scope, and continuous oversight, but the article argues that many organisations cannot operationalise those controls without overhauling their stack.
The article’s central claim is not that agentic governance is unnecessary. It is that security programmes built on fragmented tooling, proprietary integration paths, and lean operations often fail before the control model is fully deployed. For IAM, IGA, and PAM teams, that creates a practical question: can AI agent governance be absorbed into existing identity operations, or does it become a parallel programme that never scales?
Key questions
A: Security teams should treat both people and AI agents as identities that must be authenticated, authorized, and continuously monitored. Apply least privilege to reduce blast radius, separate high-risk tasks from broad access, and review permissions as models and workflows change. This matters because compromised credentials, prompt manipulation, or overbroad access can turn an AI tool into a fast-moving insider risk.
Q: Why does agentic zero trust break down in complex IT environments?
A: It breaks down when identity, policy, monitoring, and application access are split across too many tools and vendors. In that environment, least privilege becomes hard to enforce consistently, and the agent can move across systems faster than governance can follow. Fragmentation turns a sound model into a partial control.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk. Another indicator is weak visibility into who is using which tools and what data they are sending. If teams cannot answer those questions, governance is not working as intended.
Q: How do organisations keep humans in the loop for AI agent decisions?
A: They define which agent actions require approval, what evidence must be reviewed, and how decisions are logged for audit and oversight. Human-in-the-loop only works when review is operationally realistic. If the approval path is too slow or too broad, teams either bypass it or stop using the control.
Technical breakdown
Why AI agent identity needs continuous scope control
An AI agent is not just another workload if it can act across systems with delegated permissions. In Agentic Zero Trust, identity is not only about authentication at login or provisioning time. It also has to cover what the agent is allowed to touch, which tools it may invoke, and whether its actions still align with its intended purpose while it runs. That makes scope control a runtime concern, not a one-time policy exercise. If the identity layer cannot keep pace with the agent’s actions, governance becomes symbolic rather than enforceable.
Practical implication: treat agent scope as a live governance boundary, not a static approval record.
Where platform complexity breaks agentic governance
The article’s strongest operational point is that control models fail when they depend on too many proprietary integrations. If identity, policy, monitoring, and application access sit in separate stacks, AI agents move faster than the governance fabric around them. That creates a fragmentation trap: the organisation can describe least privilege, but cannot enforce it consistently across cloud services, endpoints, and third-party applications. In practice, this is less a tooling problem than an architectural one. The more stitched together the control plane becomes, the easier it is for gaps to appear between systems.
Practical implication: test whether your IAM architecture can govern an agent across environments without manual stitching.
How discovery and alignment turn into governance controls
The article names three mandates for AI security: discovery, containment, and alignment. Discovery means knowing where agentic tooling exists. Containment means limiting what it can access between services and infrastructure. Alignment means checking that the agent’s behaviour matches its intended purpose. These are not abstract principles. They are the control primitives that determine whether an AI agent remains a governed identity or becomes an unmanaged decision-making endpoint. Without discovery, there is no inventory. Without containment, there is no boundary. Without alignment, there is no assurance that access is being used as intended.
Practical implication: map agent discovery, containment, and alignment to distinct identity controls instead of treating them as one policy.
Threat narrative
Attacker objective: The objective is to exploit over-broad or ungoverned agent access so that an AI agent can act outside its intended purpose and create security or operational damage.
- Entry occurs when an AI agent is introduced into the environment with broad or poorly bounded access across internal systems and third-party services.
- Escalation follows when fragmented IAM, monitoring, and governance controls cannot consistently constrain the agent’s scope across platforms and vendors.
- Impact occurs when the agent’s access is misused, bypassed, or overextended, turning a productivity asset into an operational liability.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic Zero Trust is really a governance capacity test, not a slogan test: the article shows that the model only works when identity, scope, monitoring, and ownership can be enforced continuously across the environments agents actually use. The problem is not the control logic itself. The problem is whether the organisation can operationalise it without a separate transformation programme.
Complexity is the control failure, not merely the implementation challenge: when an AI agent has to move across multi-cloud services, endpoints, and third-party applications, fragmented identity stacks create enforcement gaps. A policy that cannot follow the agent across those boundaries is not a policy boundary in practice. Practitioners should treat platform fragmentation as a governance defect, not an inconvenience.
Verified identity and defined scope are necessary but not sufficient for agentic systems: the article correctly centres discovery, containment, and alignment, which is the right control sequence for AI agents. But the deeper issue is that these controls must live inside the existing access fabric, because a separate governance project will always trail the speed of agent deployment.
Access governance for AI agents depends on human oversight staying operational: the article notes that humans must be in the loop to approve and observe AI-driven actions. That means the identity model for AI agents cannot be detached from operating-model design. The practitioner question is not whether humans should remain responsible, but whether the review and approval process can keep up with agent timing and scale.
Agentic identity succeeds only when it is treated as part of the broader non-human identity estate: AI agents should be governed alongside workload identities, service accounts, and other non-human identities rather than as a standalone special case. That framing matters because the same operational discipline, inventory, ownership, authorisation, and monitoring must hold across all machine identities if governance is to remain coherent.
From our research library:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: Zero Trust for AI Agents
What this signals
Agentic Zero Trust will not be governed effectively if it is treated as a parallel security transformation. The control model has to sit inside the same identity operations that already govern human and non-human identities, otherwise the programme creates more process than protection.
Runtime agent governance gap: the missing control is often not policy intent but operational continuity. Discovery, containment, and alignment only matter when the organisation can apply them across every environment where an AI agent acts, including third-party applications and multi-cloud services.
Security leaders should assume that agent adoption will keep accelerating across core infrastructure, which makes identity operations the limiting factor. If the identity stack cannot unify ownership, scope, and monitoring, AI governance becomes a backlog item instead of a control plane.
For practitioners
- Define verified identity for every AI agent Assign a named owner, unique identity, and lifecycle record before any agent is allowed to act across business systems.
- Bound agent scope to named systems and actions Document exactly which applications, data sets, and functions each agent may use, then deny everything else by default.
- Consolidate governance into the existing identity fabric Avoid separate control planes that require new admin workflows for every agent. Use one identity model that can govern human and non-human identities together.
- Track discovery, containment, and alignment as separate controls Inventory where agents exist, restrict inter-service permissions, and validate that agent actions remain tied to their intended purpose.
- Keep humans in the approval loop for high-risk agent actions Define which agent actions require human review, what evidence must be presented, and how observation is recorded for auditability.
Key takeaways
- Agentic Zero Trust fails in practice when identity governance is too fragmented to follow AI agents across the systems they use.
- The article frames discovery, containment, and alignment as the control trio that matters, but says complexity often prevents those controls from being enforced consistently.
- For practitioners, the key implication is to embed AI agent governance into existing identity operations rather than building a separate security programme around it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on AI agents needing bounded identity and privilege. |
| Recommendation — Apply ASI03 to bound agent identity, privilege, and scope across all environments. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Verified identity is a core requirement for every AI agent discussed here. |
| NHI-05 — Overprivileged NHI | The article warns that broad agent privileges become a security liability. | |
| Recommendation — Enforce secure authentication for every AI agent before it receives operational access. Review agent permissions for over-privilege and strip access that is not explicitly required. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The topic is fundamentally about governing entitlements for AI agents. |
| Recommendation — Use PR.AA-05 to manage AI agent permissions, entitlements, and authorizations continuously. | ||
| NIST Zero Trust (SP 800-207) | Section 3 — Zero Trust Architecture Principles | The article explicitly extends zero trust principles to AI agents. |
| Recommendation — Apply zero trust principles to AI agents across identities, networks, and applications. | ||
Key terms
- Agentic zero trust: An access model that applies zero trust principles to AI agents by requiring verified identity, explicit scope, and ongoing validation of behaviour. It treats the agent as a governed actor whose actions must remain bounded across tools, services, and environments.
- Agent Scope Manifest: An agent scope manifest is a versioned description of what tools, destinations, and actions an AI agent is allowed to use. It gives security teams a concrete baseline for detecting scope deviation and for limiting the blast radius when model behaviour drifts or is manipulated.
- Human-in-the-Loop (HITL): A governance pattern requiring human approval before an AI agent takes high-impact, irreversible, or out-of-scope actions. HITL is a critical control for agentic AI identity governance.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org