AI agent governance needs decision-centric authorization, not login checks

At a glance

What this is: This is an analysis of why AI agent governance breaks when authorization is limited to login checks rather than runtime decisions.

Why it matters: It matters because IAM, PAM, and Zero Trust programmes have to govern what agents do after authentication, not just who can authenticate in the first place.

By the numbers:

• 86% of security leaders don't enforce access policies for AI identities.
• 85% still rely on login-based authentication methods designed for human users.
• 70% of security leaders have already discovered unauthorized AI tools running with elevated access in production.
• 92% lack full visibility into their AI identities.

Context

AI agent governance fails when enterprises treat authentication as the control boundary. An AI agent can authenticate once and then continue making tool calls, sending messages, and accessing data long after the login event has ended.

This article is about the gap between who can sign in and what an autonomous actor is allowed to do next. For IAM, PAM, and NHI governance, that gap becomes the main control problem once agents inherit credentials or operate with delegated access.

The central issue is not whether AI agents exist inside the enterprise. It is whether decision rights, resource scope, and contextual policy are enforced at runtime, where agent behaviour actually unfolds.

Key questions

Q: What breaks when AI agents are governed only with login-based IAM?

A: Login-based IAM breaks because it stops at authentication and never evaluates the thousands of actions an autonomous agent may take after sign-in. The result is broad delegated access with no runtime control, which makes inherited credentials, token reuse, and chained actions effectively invisible to governance teams. Runtime authorisation is the missing control plane.

Q: Why do AI platforms need runtime authorization instead of static application controls?

A: AI platforms combine users, agents, APIs, prompts, and backend data in ways that static code checks cannot govern consistently. Runtime authorization evaluates each action at the moment it occurs, so policy can reflect context, object ownership, and intended behaviour. Without that layer, one exposed interface can cascade into data access and system manipulation.

Q: What are the signs that AI governance is failing in the enterprise?

A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk. Another indicator is weak visibility into who is using which tools and what data they are sending. If teams cannot answer those questions, governance is not working as intended.

Q: What should organisations do when AI agents start using inherited credentials?

A: Treat those agents as governed identities rather than untracked automation. Scope their credentials tightly, log every action back to a human owner, and make revocation part of the operational model. Otherwise, agent activity will outgrow session-based IAM assumptions and create access that is hard to explain or remove.

Technical breakdown

Why login-based IAM fails for AI agents

Login-based IAM assumes access is granted to a person or service and then remains broadly stable for the session. AI agents break that assumption because they can chain actions, call tools, and cross systems after the initial authentication event. That means the security decision point moves from identity proofing to per-action authorization. The practical difference is that a valid login says little about whether an agent should be allowed to send an email, read a record, or invoke another tool a second later.

Practical implication: move authorization checks from session entry to each sensitive agent action.

Decision-centric authorization and runtime policy

Decision-centric authorization evaluates each requested action against context such as actor type, resource sensitivity, delegation chain, and current conditions. This is closer to the way agent behaviour actually works than static RBAC or coarse session permissions. It also aligns with Zero Trust Architecture, where trust is never assumed just because the actor authenticated earlier. For AI agents, the policy question is no longer whether they are logged in, but whether this specific operation is allowed right now.

Practical implication: define policy at the action layer, not only at onboarding or login.

Shadow AI agents as inherited-credential systems

Shadow AI agents are unmanaged autonomous tools running with inherited tokens, OAuth grants, or other delegated credentials. The risk is not only that they exist outside formal approval. It is that they can persist across systems with access that no one is actively inventorying or recertifying. In NHI terms, this looks like delegated privilege without lifecycle control, which makes the agent behave like a hidden non-human identity with broad reach and weak accountability.

Practical implication: inventory every agent that can act through inherited credentials and tie it to an owner.

Threat narrative

Attacker objective: The objective is to use a legitimately authenticated autonomous actor to perform high-impact actions that bypass the organisation's intended authorization boundary.

1. Entry occurs when an agent is deployed or inherited inside the enterprise with delegated credentials, OAuth tokens, or employee-linked access rather than being blocked at login.
2. Credential access is not gained by cracking authentication but by reusing already-granted identity material that lets the agent operate across tools and systems.
3. Escalation happens when the agent chains actions, expands across services, and performs operations that were never individually reviewed against current context.
4. Impact is the unauthorized movement of data or execution of actions that the enterprise assumed would be constrained by human-paced oversight.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Decision-centric authorization is the correct control boundary for autonomous actors: login checks answer a human-era question, not an agent-era one. When an AI agent can keep acting after authentication, the control plane has to evaluate each action, not the session that preceded it. Practitioners should treat runtime authorization as the governance primitive, not an add-on to IAM.

The authorization gap is a broken governance assumption, not a missing tool: the assumption that authenticated identity implies governable behaviour was designed for users whose requests are discrete and visible. That assumption fails when an AI agent can chain tool calls, inherit tokens, and keep moving without a new human decision. The implication is that identity policy must be expressed as decision policy.

Shadow AI is becoming a non-human identity lifecycle problem: unmanaged agents are not just unsanctioned software, they are identities with inherited access that no one can readily enumerate, review, or offboard. Once those credentials are in play, the lifecycle problem becomes ownership, scope, and revocation. Practitioners should stop treating agent discovery as separate from NHI governance.

Ephemeral login, persistent authority: the real risk is not authentication failure but authority that outlives the login event. Agentic behaviour collapses the usefulness of controls that assume a stable human operator behind the session. The practical conclusion is that governance has to follow the action stream, not the sign-in screen.

Autonomous agents are forcing IAM and Zero Trust to converge on per-decision control: the old split between identity verification and resource authorization no longer holds when software decides what to do at runtime. That pushes security teams toward policy engines, contextual enforcement, and auditable decision records. The field is moving from access management to continuous decision governance.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: Zero Trust for AI Agents

What this signals

Decision-centric authorization: agent governance has to move from session-based access to per-action enforcement, because the relevant security event is the choice the agent makes at runtime, not the fact that it logged in once.

The longer enterprises rely on human IAM patterns for agentic systems, the more they will discover a structural mismatch between authentication and authorization. That mismatch will show up first as shadow deployments, then as unaudited tool use, and finally as compliance gaps that cannot be reconstructed from login logs alone. A control model built for people cannot be the last word on autonomous software behavior.

Access reviews assume that privilege remains stable long enough to be certified, but autonomous agents can acquire and use access inside a single decision chain, leaving review cadences blind to the real risk.

For practitioners

• Define action-level authorization boundaries Specify which agent actions require per-request evaluation, including email, file access, API calls, and delegated tool use. Treat these as distinct decisions rather than one session permission.
• Inventory shadow AI identities and their credentials Map every agent that can operate with inherited OAuth tokens, service credentials, or employee-linked access. Assign ownership, scope, and offboarding responsibility for each one.
• Separate authentication from authorization controls Keep login mechanisms in place, but do not assume they constrain agent behaviour after sign-in. Add runtime policy enforcement where the agent actually chooses actions.
• Log and review every agent decision path Capture the actor type, delegation chain, resource touched, and decision outcome for each sensitive action so audits can reconstruct what the agent was allowed to do and why.
• Rework recertification for autonomous actors Do not recertify agents on the same cadence used for human accounts if their privileges can change dynamically. Review the decision policy and ownership model, not just a static access list.

Key takeaways

• AI agents expose a governance gap between authentication and authorization that traditional IAM was never designed to close.
• The article grounds that gap in enterprise evidence, including unauthorized AI tools, weak visibility, and login-based controls that still dominate.
• Runtime decision controls, not login checks, are the practical control shift that determines whether agent behaviour stays governable.

Key terms

• Decision-centric authorization: Decision-centric authorization is a governance model that evaluates each action before it happens, using identity, context, and policy together. For autonomous or machine-speed actors, it is more reliable than static access grants because it tracks behaviour as it unfolds.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Authorization Gap: The distance between what an authenticated identity can do and what it is actually permitted and proven to do in real time. For AI agents, the gap widens when decisions are made per action, at machine speed, and through workflows that expand faster than human review cycles.
• Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.