AI agent access is breaking traditional identity security models

At a glance

What this is: This is an analysis of why AI agent access is outpacing traditional identity controls, with the key finding that setup-time permissions and observability are not enough for runtime governance.

Why it matters: IAM, PAM, and NHI teams need to rethink delegated access, action-time authorization, and accountability because agentic systems can expand privilege faster than existing review and approval models can contain.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• Machine identities already outnumber human identities 82 to 1 across organizations worldwide.
• Microsoft Copilot Studio and SharePoint users created over one million custom agents in a single quarter in 2025, up 130% from the previous period.

👉 Read Cakewalk's analysis of AI agent access and identity security

Context

AI agent identity risk is no longer theoretical. The problem is not simply that agents can connect to tools, but that they act with delegated access, make runtime decisions, and often inherit permissions that were designed for humans rather than autonomous execution.

That mismatch creates a governance gap across IAM, NHI, and access review processes. When access is defined at setup time and execution happens later at machine speed, traditional controls struggle to answer a basic question: which action should be allowed in this exact context, by this exact agent, on behalf of this exact user?

Cakewalk frames the issue around the missing authorization layer for agents, and that framing is typical of the current market. The broader pattern is already visible across software engineering, back-office automation, and business workflows, where agent deployment is expanding faster than governance maturity.

Key questions

Q: What breaks when AI agents are governed with human IAM, IGA, and PAM models?

A: Human identity models assume a known person, a start date, a manager, and predictable access review cycles. AI agents break those assumptions because they can be created outside HR, inherit access, and act continuously through delegated credentials. The result is governance blind spots across provisioning, privilege control, and certification.

Q: Why do NHIs complicate zero trust and least privilege efforts?

A: NHIs complicate zero trust because they are numerous, persistent, and often tightly integrated into applications and pipelines. If teams cannot see every identity or keep permissions aligned to actual usage, they cannot consistently prove least privilege. Continuous review and revocation are essential, not optional.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.

Q: Who is accountable when an AI agent uses delegated access incorrectly?

A: Accountability should follow the delegated authority chain, not stop at the agent label. The relevant owners are the teams responsible for the human identity, the service identity, the workflow, and the policy that allowed the action path. If those responsibilities are not explicit, incident review will be incomplete and remediation will focus on the wrong layer.

Technical breakdown

Why setup-time authorization fails for AI agent access

Traditional IAM assumes the authenticated subject and the decision-maker are the same entity, but agentic systems break that model. An agent may authenticate once, then discover tools, data, and actions at runtime based on what it encounters. If authorization only happens at connection time, the system grants a broad envelope of privilege before the actual action is known. That is why static scopes, borrowed human OAuth credentials, and inherited service-account permissions become blunt instruments. The real control problem is not identity proofing. It is whether each action can be evaluated before execution against policy, context, and delegated intent.

Practical implication: move from session-level approval to per-action authorization for any agent that can reach sensitive systems.

Why observability alone cannot govern agentic access

Logging and alerting tell you what happened after the fact, but they do not stop an agent from reading data, sending it externally, or chaining actions across systems. For humans, there is often a pause between access and consequence. For agents, that window can collapse to near zero. This is why tool-call observability is useful for forensics but weak as a primary control. Governance for agents needs an enforcement point that sits between decision and execution, not just dashboards that reconstruct events later. Otherwise the organisation gets evidence without prevention.

Practical implication: pair agent telemetry with pre-execution policy checks or the control plane will remain reactive.

Why borrowed human credentials create governance debt

Many agent deployments still use human OAuth tokens or long-lived access grants because there is no mature authorization layer purpose-built for agents. That creates a structural mismatch between the permission model and the actor. A human can be reviewed, challenged, and held accountable; an agent can inherit access, fan out across tools, and keep operating without a clear boundary between delegated and undesired action. The result is not just over-permissioning. It is governance debt that accumulates every time an agent is trusted with a broader scope to avoid workflow failure.

Practical implication: inventory every agent that borrows human credentials and treat the scope as a temporary liability, not a stable design choice.

Threat narrative

Attacker objective: The objective is to turn delegated AI agent access into a high-speed path to data exposure, destructive actions, or lateral movement across connected business systems.

1. Entry occurs when an attacker or rogue workflow gains access through exposed or borrowed credentials that an AI agent is already using to reach connected systems.
2. Escalation happens when the agent inherits broad permissions and can discover additional tools, databases, or APIs at runtime without a separate authorization layer.
3. Impact follows when the agent reads, modifies, or exfiltrates sensitive data faster than human review or post-event monitoring can intervene.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent access is an IAM problem only if organisations treat agents as humans with faster hands. That assumption is already failing. Agents do not just authenticate and execute a fixed role; they discover tools, decide paths, and expand their own operational surface at runtime. The implication is that identity programmes must stop modelling agent access as a static entitlement problem and start treating it as runtime authorisation.

Action-time authorisation is the missing control boundary for agentic systems. Setup-time checks assume the identity’s intent is known before execution begins, but autonomous behaviour makes intent emergent. That breaks the premise behind broad session grants, inherited OAuth scopes, and many access review workflows. Practitioners should recognise that the control gap is not visibility, it is the absence of a policy decision point between agent action and execution.

Observability without enforcement produces evidence, not governance. Many teams are instrumenting agent behaviour after deployment, but logs only confirm that an access decision was already made and executed. This is especially weak where agents can chain actions across tools in seconds. For identity leaders, the lesson is that telemetry belongs beside a control, not in place of one.

Delegated access creates accountability drift when the actor is no longer the person who approved the work. Traditional IAM assumes a stable human operator behind every privileged decision. Agentic systems break that assumption because the human initiator, the delegated identity, and the runtime decision-maker are not the same entity. That means governance, audit, and policy ownership must be rethought across human, NHI, and autonomous layers.

Runtime governance gap: The industry now has enough connectivity for agents, but not enough independent governance for their actions. MCP-style integration, SaaS connectors, and workflow automation make access easy to extend, yet the policy layer remains fragmented. Practitioners should expect the market to converge on per-action enforcement, not broader agent permissions, because the older model cannot contain emergent behaviour.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
• 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That same research shows 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, which points directly to the governance gap described in this post.

What this signals

Runtime authorisation will become the dividing line between agent enablement and agent exposure. Teams that continue to rely on setup-time grants will keep expanding access faster than they can review it. The practical shift is toward policy enforcement at the point of action, especially where AI agents touch sensitive data, production systems, or external APIs.

With 80% of organisations already reporting AI agents acting beyond intended scope, the control problem is no longer theoretical. The governance baseline is moving from permissions management to delegated decision management, and that affects IAM, PAM, and IGA design together. Teams should prepare for audit questions that ask not just who had access, but which action was allowed and why.

Action-time governance needs to be built into identity architecture, not bolted onto monitoring. The organisations most exposed are those where agents borrow human credentials, inherit broad scopes, and then operate faster than approval workflows can respond. That is where identity blast radius grows, and it is where access policy will need to sit closer to execution than to authentication.

For practitioners

• Inventory every agent and delegated credential path Map which agents use human OAuth grants, service accounts, API keys, or token inheritance, then document the systems each one can reach and the approval chain behind it.
• Move critical decisions to action time Require a policy check before each tool call, database query, or external request when an agent touches sensitive systems, rather than relying on setup-time approval.
• Separate observability from enforcement Keep logs and traces for forensics, but place an independent control point between the agent’s decision and execution so monitoring does not become the only safeguard.
• Bound delegated scope to the initiating user Ensure the permissions available to an agent never exceed the entitlements of the human it is acting for, and revoke access automatically when the task or session ends.
• Identify where workflow failure currently drives over-permissioning Find the places where teams grant broad access only because agent tasks break when permissions are too narrow, then redesign those flows so least privilege does not depend on guesswork.

Key takeaways

• AI agents break the assumption that the authenticated entity is the same entity making the access decision.
• The biggest governance gap is not visibility, but the absence of action-time authorization for delegated agent behaviour.
• Identity teams should treat agent access as a runtime control problem, not a static permissions problem.

Key terms

• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
• Action-time Authorization: Action-time authorization means checking whether a specific operation is allowed at the exact moment it is invoked, using the current identity, context, and policy. For AI and NHI systems, this matters because possession of a key or session should not automatically permit every downstream action.
• Delegated Identity: Delegated identity is when one actor acts on behalf of another with explicit permission and bounded authority. In AI-assisted commerce, it requires clear consent, limited scope, and traceable records so the retailer can distinguish authorised delegation from unauthorised automation.
• Governance Debt: The accumulation of unresolved identity control weaknesses created when teams prioritise speed over lifecycle design. In NHI environments, it shows up as accounts with unclear ownership, undocumented purpose, stale credentials, and no reliable retirement path, all of which make later security work harder.

What's in the full article

Cakewalk's full article covers the operational detail this post intentionally leaves for the source:

• A runtime walk-through of how agents discover tools, choose actions, and execute across systems without fixed workflows.
• The article's full discussion of why borrowed human OAuth credentials create governance gaps for delegated agent access.
• Specific examples of where setup-time permissions fail when an agent encounters a database, API, or deployment pipeline at runtime.
• Cakewalk's closing recommendations on where security, compliance, and engineering teams should begin reworking access decisions.

👉 Cakewalk's full article covers the missing authorization layer, runtime access model, and security team implications.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.