AI agent authorization is exposing long-standing governance gaps

At a glance

What this is: This is a conference analysis of how AI agents are exposing long-standing authorization and delegation gaps that human-paced workflows had masked.

Why it matters: IAM and governance teams need to rethink how they authorise delegated actions, because runtime context, cross-domain trust, and agent behaviour now shape the decision itself.

Context

AI agent authorization is the problem of deciding what an autonomous system may do on behalf of a user, across a resource, at the moment a request is made. The gap is not only technical. It is a governance problem because many identity programmes still assume access can be reviewed after the fact, even when the actor is making non-deterministic decisions at runtime.

Cerbos' Identiverse take was that agents are not inventing new weaknesses so much as exposing old ones that human-operated workflows could hide. Once an actor can initiate action on its own behalf, authorization has to move from static permission assumptions to decision-time evaluation, with context available before the call is allowed to execute.

Key questions

Q: How should IAM teams authorize autonomous agents at runtime?

A: They should authorize autonomous agents at the moment of action, using subject, action, resource, and context rather than relying on static entitlements. The control should evaluate current purpose, trust state, and risk before the request executes, because agent behaviour can change within a single session.

Q: Why do quarterly access reviews fail for AI agents and NHIs?

A: Quarterly reviews fail because they assume access stays stable long enough for a human to inspect it. AI agents and modern machine identities can change scope much faster than a calendar cycle can capture, so the programme sees stale state. Continuous change demands event-driven controls and live entitlement context, not slower certification.

Q: What breaks when delegation crosses trust domains?

A: The delegation chain becomes hard to verify unless the original principal, purpose, and external authority remain visible at every hop. Cross-domain trust cannot depend on informal assumptions, because the trustee may be outside your control and the policy obligations may need to travel with the delegation.

Q: How can security teams keep agent decisions auditable?

A: They should log the policy intent, the inputs used at evaluation time, and the resulting action so the decision can be traced back to the original principal. That creates evidence for accountability even when multiple hops, services, or context signals were involved in the final outcome.

Technical breakdown

Why autonomous agents break static authorization assumptions

An autonomous agent is not just a tool user. It can choose actions, combine tools, and time execution without waiting for a human approval gate, which means the old assumption that access is stable long enough to be reviewed starts to fail. In identity governance terms, the decision can no longer be treated as a snapshot of entitlement. It has to be evaluated against current context, current purpose, and current trust state. That is why OAuth scopes alone are too coarse for agentic use cases, and why subject-action-resource-context models matter more at the decision point.

Practical implication: Move authorization checks to the point of action so the policy can evaluate the specific request, not a stale entitlement snapshot.

How delegated authorization changes across trust domains

Delegation works differently once the trustee sits in another organisation or trust domain. Inside one company, teams can often rely on shared controls, but cross-org delegation needs the chain, the original principal, the purpose, and any obligations to remain visible across hops. That is the core of the crossing the trustee problem. If the policy decision point cannot verify who delegated what, for what purpose, and under which external authority, the chain becomes hard to audit and harder to revoke cleanly. This is where obligations at runtime become part of the authorization decision, not a separate afterthought.

Practical implication: Model delegated authority explicitly across domains and preserve revocation, purpose, and auditability through every hop.

What continuous signalling adds to runtime governance

Shared Signals shifts governance from a one-time login event to a continuous stream of context. Instead of assuming a session remains valid because it was valid at start, systems can receive revocation, risk, and provisioning signals and react locally. For agents, that matters because the signal can reach the point of enforcement before the decision is made. The architecture described in the article is a control plane for trust setup, a data plane for fast authorization, and a signalling plane for fresh context. That combination turns governance into a live decision workflow rather than a periodic review exercise.

Practical implication: Use event-driven signals to update policy decisions continuously, especially when agent scope or trust state changes mid-session.

Threat narrative

Attacker objective: The objective is to obtain unauthorized or overbroad action through an agent that was trusted to act on behalf of a principal.

1. Entry occurs when an agent receives delegated authority from a user or system and begins acting with implicit trust that was created at setup time.
2. Escalation happens when the agent combines tools, context, or downstream services in ways that were not individually reviewed at the moment of execution.
3. Impact follows when the authorisation boundary is crossed in real time, allowing unintended actions, token minting, or policy bypass across trust domains.

Breaches seen in the wild

• Taiwan autonomous AI agent cyberattack 2026: Up to eight autonomous AI agents cracked 85 Taiwanese government accounts, pivoted through SSO and exfiltrated 2,564+ personnel records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Autonomous agents expose an assumption collapse in access governance: access review processes were designed for privileges that persist long enough to be seen, sampled, and certified. That assumption fails when the actor can acquire and release authority within a single session, because there may be no stable entitlement state to review at all. The implication is that governance must move from entitlement records to decision-time enforcement.

Cross-org delegation is now the harder identity problem than authentication: once an agent operates across trust domains, contracts and trust lists are no longer enough to prove who may act, for what purpose, and under whose authority. The article’s “crossing the trustee” problem is the right framing because the delegation chain becomes the control surface. Practitioners need to treat delegated authority as an auditable identity object, not a loose permission trail.

Decision governance is replacing snapshot governance as the meaningful control plane: authorization, policy signals, and runtime context are converging into one layer. That matters because the real control is no longer whether a principal once had access, but whether the current action matches policy, purpose, and risk at the moment of execution. Teams that still anchor governance in quarterly review cycles will continue to miss the actual decision boundary.

Shared Signals, AuthZEN, and SPIFFE are complementary because they solve different parts of the same runtime problem: identity proof, decision evaluation, and live context distribution have to line up before an agent acts. No single standard solves the whole chain. The practitioner takeaway is to think in terms of an authorization system architecture, not a point product or a single policy file.

AI agent identity governance should be judged by whether it can preserve accountability across a chain: the article makes clear that the difficult questions are not only about permission, but about auditability, revocation, and purpose propagation across hops. That is where many current models degrade. Practitioners should expect the most value from designs that keep the original principal visible from the first delegation through the final decision.

What this signals

Decision governance is now the practical centre of gravity for agentic identity: if a system can decide and act within the same runtime loop, then entitlement records alone no longer describe the security boundary. The important question becomes whether the policy engine can evaluate the current request with enough context to stop unsafe execution before it happens.

Cross-org delegation will separate mature programmes from fragile ones: enterprises that cannot preserve purpose, revocation, and auditability across trust domains will struggle as agents begin to operate outside a single administrative boundary. That makes delegated authorization a governance problem, not just an architecture choice.

For practitioners

• Define runtime authorization checkpoints Place policy decision points where the agent actually acts, so the system evaluates subject, action, resource, and context before execution rather than after the fact.
• Map delegated authority end to end Record the delegator, delegatee, purpose, and any external authority for multi-hop chains so cross-domain decisions remain auditable and revocable.
• Treat session signals as governance inputs Feed revocation, risk, and provisioning events into enforcement so trust changes can narrow scope or stop actions before a task completes.
• Rework access reviews for agentic systems Use reviews to validate policy intent and decision logs, not to prove static entitlement states that may disappear before the next review cycle.
• Separate trust setup from action approval Use one control path to establish who or what an agent is, and a separate path to decide what it may do on each request.

Key takeaways

• Autonomous agents expose a governance assumption that static access reviews were built for stable privileges, not runtime decision loops.
• Cross-domain delegation needs explicit authority, purpose, and revocation handling, or accountability becomes ambiguous the moment the chain leaves one organisation.
• The strongest control point is the authorization decision itself, because that is where policy, context, and action meet in time to prevent misuse.

Key terms

• Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
• Cross-Org Delegation: Delegating authority across organisational boundaries while preserving who authorised the action, for what purpose, and under which external trust conditions. In agentic systems, this becomes a governance problem because the chain can span systems that do not share the same control domain.
• Decision Governance: Decision governance is the practice of governing the authorization decision itself rather than only the identity record or entitlement list. It focuses on the subject, action, resource, and context that produced the result, which is especially important when agents and service accounts can act dynamically at runtime.
• Shared Signals: Shared signals are trusted security events passed from one system to another so access decisions can change immediately. In identity programs, they let an IAM platform react to device compromise, session risk, or policy changes without waiting for a human ticket or review cycle.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.