AI agent and NHI governance need runtime enforcement, not prompts

At a glance

What this is: This webinar frames AI agent governance as an extension of long-standing NHI failures, with runtime enforcement and ownership clarity as the key findings.

Why it matters: It matters because IAM, IGA, PAM, and NHI teams are now being asked to govern systems that can act beyond prompt intent, using credentials and access paths that were never designed for that behaviour.

By the numbers:

• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.

👉 Watch Clarity Security’s webinar on AI agent and NHI identity governance

Context

AI agent governance becomes an identity problem when the system can act, access data, and call tools at runtime rather than simply execute a fixed workflow. This webinar argues that the underlying NHI problem is older than AI, but the arrival of agents has exposed how weak discovery, static credentials, and unclear ownership were already failing identity programmes.

For IAM and security teams, the practical issue is no longer whether agents exist, but whether they can be observed, assigned, and constrained in a way that survives role changes, workload churn, and delegated access. The discussion places observability first because you cannot govern what you cannot enumerate, and that is a familiar failure mode in NHI environments.

The article’s starting point is typical, not exceptional: most enterprises already have fragmented service accounts, API keys, and cloud workload identities, and agents simply add another layer of unmanaged access on top.

Key questions

Q: How should security teams govern AI agents that choose tools at runtime?

A: Security teams should treat runtime tool choice as a governed access event, not a normal application call. That means task-scoped credentials, explicit approval boundaries for sensitive actions, and logs that record both the tool selected and the identity used. If the agent can change its plan, the control model must be able to change with it.

Q: Why do AI systems create NHI governance problems?

A: AI systems often rely on service accounts, tokens, APIs, and delegated permissions that behave like non-human identities. If those identities are not governed tightly, the system can access data or trigger actions beyond what people intended. That makes AI governance inseparable from identity and access control.

Q: What breaks when ownership for an agent is tied to the person who built it?

A: Accountability becomes fragile the moment that person changes role, leaves, or loses context. The organisation can no longer reliably answer who is responsible for offboarding, review, or incident response. Ownership should sit with the team responsible for the workload or product, because that boundary survives staffing change.

Q: Who is accountable when an AI agent causes a security incident?

A: Accountability should sit with the business owner, the system owner, and the security function together, because agent behaviour crosses operational boundaries. Organisations need a defined owner for approval, monitoring, and retirement, plus audit evidence that shows what the agent accessed and why.

Technical breakdown

Why runtime enforcement matters more than agent instructions

Agent governance fails when security assumes natural-language instructions are enforceable controls. A prompt, policy note, or .md file is advisory text, not a runtime authorisation decision. If an agent can decide to call tools, reach databases, or trigger another workflow, the real control point is the permission check at the moment of execution. That is why just-in-time access and policy evaluation must happen at runtime, with the decision tied to the specific action and context rather than the agent’s declared intent. In identity terms, the question is not what the agent was told, but what it was allowed to do when it tried.

Practical implication: move agent governance from instruction management to runtime access enforcement and decision logging.

Observability across humans, NHIs, and AI agents

Observability is the prerequisite for any governance model that spans humans, service accounts, API keys, and agents. That means knowing what identities exist, what they can access, what credentials they use, and which systems they touch. In NHI programmes this is often the hardest part because credentials are scattered across code, CI/CD, vaults, and cloud services. For agents, the bar is higher because access can expand during execution and may be granted through chained calls. Without a unified inventory and ownership model, the organisation cannot distinguish legitimate access from uncontrolled sprawl.

Practical implication: build a single inventory that links each identity to owner, privilege, credential source, and downstream access.

Why ownership has to sit with the product or workload team

Identity ownership becomes unstable when it is assigned to an individual rather than the team that runs the product, workload, or agent. People move roles, leave, or lose context, but service ownership needs continuity across the lifecycle of the identity. That is especially true for NHIs and AI agents, where accountability must survive deployment changes, model updates, and application rewrites. IAM teams can govern the process, but the business owner must remain attached to the operational context that consumes the identity. Otherwise, offboarding and incident response become guesswork.

Practical implication: assign ownership to the team responsible for the workload and make lifecycle duties part of that operational boundary.

Threat narrative

Attacker objective: The objective is to turn loosely governed agent access into uncontrolled action against data, systems, or business workflows.

1. Entry begins when agents inherit broad access through static credentials, shadow deployments, or poorly governed delegated permissions.
2. Escalation occurs when the agent expands its scope at runtime, chains additional tool calls, or uses access beyond the original prompt intent.
3. Impact follows when the agent reaches production data, destructive actions, or downstream systems without a reliable human review point.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime instruction is not runtime control: Prompt guidance was designed for systems that follow human-authored intent, not for actors that select actions at execution time. That assumption fails when an agent can choose tools, expand scope, and complete actions without a human approval gate. The implication is that security programmes must stop treating prompt text as a governance boundary and start treating runtime authorisation as the boundary.

Observability debt is now identity debt: The same visibility gap that has long affected NHIs is now widening with shadow AI and agent sprawl. If teams cannot enumerate identities, they cannot assign ownership, certify access, or detect scope drift. For practitioners, the governance problem is no longer a missing dashboard, but an incomplete identity model.

Ownership must follow the workload, not the individual: Assigning agent accountability to the person who built it creates continuity failure the moment that person changes role or leaves. Mapping ownership to the product or application team keeps the accountability chain intact across deployment, staffing, and vendor transitions. The implication is that lifecycle governance has to be organisational, not personal.

Dynamic privilege is the only defensible operating model for agents: Long-lived static API keys recreate the same trust debt that has already damaged NHI programmes. Agents that can chain actions at runtime need ephemeral, task-scoped access because least privilege defined at build time is too blunt for unpredictable execution paths. The practical conclusion is to design access around execution moments, not just identity creation.

Identity blast radius is the right concept for agentic programmes: Agents, NHIs, and human users now share the same downstream systems, but not the same control assumptions. The more identities can self-extend access or reach new tools, the larger the identity blast radius becomes when one boundary fails. Practitioners should treat blast radius as the governing metric for agent deployment readiness.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• This is why lifecycle controls matter too. Read Ultimate Guide to NHIs for lifecycle processes for managing NHIs to connect discovery, rotation, and offboarding into one operating model.

What this signals

Shadow AI will behave like the rest of your NHI estate unless the control model changes. The practical problem is not whether agents are novel, but whether they inherit the same unmanaged credential patterns that already affect service accounts and API keys. In environments where 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, the governance gap is already structural.

Runtime enforcement now belongs in the identity programme, not just the application stack. Security teams should expect pressure to prove that agent actions are authorised at the moment they occur, not merely constrained by design intent. That means linking identity inventory, lifecycle governance, and policy enforcement in a way that survives workload change and staff turnover.

The strongest programme signal is whether ownership, visibility, and revocation can be demonstrated across humans, NHIs, and agents in one reporting view. If that cannot be shown, the organisation is still operating with separate identity models that will fail under delegated and autonomous access.

For practitioners

• Inventory every agent and NHI in one control plane Map each identity to owner, credential source, allowed tools, and downstream systems before expanding deployment. Include shadow AI, service accounts, API keys, and any delegated access used by automated workflows.
• Separate ownership from IAM administration Assign business ownership to the product or workload team, then make IAM responsible for lifecycle enforcement, review, and revocation. This keeps accountability stable when staff move or leave.
• Enforce access at runtime, not in prompts Require a policy decision at the moment an agent attempts a sensitive action, and only grant ephemeral credentials for that specific step. If the action is out of scope, block it before execution.
• Replace static agent credentials with ephemeral access Eliminate long-lived API keys and hard-coded secrets from agent workflows. Tie each credential to a single task, log the action that justified it, and revoke it immediately after use.
• Test agent behaviour with full permissions exercises Run controlled simulations that let an agent operate with broad access, then inspect how quickly it expands its own permission set and what it can touch beyond the original scope.

Key takeaways

• AI agent governance is an identity problem, not just an application problem, because runtime access decisions determine what the agent can actually do.
• Visibility, ownership, and lifecycle discipline remain the foundation of NHI security, and they become more urgent once agents can expand scope during execution.
• Static credentials and prompt-only controls do not survive agentic behaviour, so practitioners need runtime enforcement and ephemeral access as the default model.

Key terms

• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.

What's in the full article

Clarity Security’s full webinar covers the operational detail this post intentionally leaves for the source:

• The discussion on unified governance across human, non-human, and agent identities, including how observability should be structured.
• The runtime enforcement examples behind the PocketOS reference, including how access decisions should be made at execution time.
• The ownership model debate for AI agents, including how accountability should be assigned across product and IAM teams.
• The practical board-level framing for explaining data exfiltration, production incidents, and competitive exposure.

👉 The full Clarity Security webinar covers ownership accountability, runtime enforcement, and observability for AI agents and NHIs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.