TL;DR: AI can dynamically compose actions across live data, and Delinea’s October 2025 analysis shows that orphaned agents, exposed session tokens, and overly broad access create breach and compliance risk when authorization is reduced to a single gate. The real issue is that identity programmes still assume access is stable, reviewable, and human-paced.
At a glance
What this is: This is an October 2025 Delinea analysis arguing that AI agent risk is driven by dynamic action chains, exposed session tokens, and orphaned access that traditional authorization gates do not control.
Why it matters: IAM, PAM, and NHI teams need to move beyond one-time approval models because AI systems can act inside sessions, reuse credentials, and outlive the humans who created them.
Context
AI agent guardrails are a governance problem as much as a security problem. When a system can decide actions at runtime, pull live data, and combine multiple functions without human intervention, a single authorization gate no longer describes the real risk boundary.
The article focuses on AI agent identity, session control, and authorization drift. It also shows how the same controls that govern human and machine access start to fail when access is dynamic, continuous, and tied to autonomous execution rather than a one-time login.
Key questions
Q: What breaks when AI agents rely on a single authorization gate?
A: A single gate breaks when the agent can keep acting after the initial decision, because runtime behaviour can diverge from the original approval. The practical failure is that intent, tool use, and asset sensitivity are no longer re-evaluated where risk actually appears. That leaves teams with a green light that no longer matches reality.
Q: Why do exposed session tokens create such a high-risk path for AI workflows?
A: Because a session token can let an attacker or rogue process impersonate an active user and inherit whatever the session can already reach. In AI workflows, that often means live data, privileged commands, or APIs. The risk is not just compromise of the token, but the downstream authority it unlocks.
Q: When does an AI agent become a governance problem instead of an automation benefit?
A: An agent becomes a governance problem when it can discover secrets, call privileged APIs, or affect production without continuous oversight. At that point, the question is no longer whether the model is safe. The issue is whether the organisation can prove who authorized the action, what scope was intended, and how it will be revoked.
Q: How should security teams bound AI agent risk in privileged sessions?
A: Teams should bound the agent by session-level policy, not by trust in the model or the initial login. That means limiting target assets, watching commands in real time, and using intent and asset sensitivity to decide whether the action should continue. If the session can move beyond the approved use case, the control boundary is too loose.
Technical breakdown
Why a single authorization gate fails for AI agents
Traditional authorization assumes that access can be checked once, then safely carried through a session or task. AI agents break that model because they can chain actions, call tools, and pivot across data sources after the initial decision. The control problem is not authentication alone. It is whether the system can still judge intent, need, and asset sensitivity after the session has already started. That is why gate-based approval is too coarse for agents that can alter their own execution path at runtime.
Practical implication: treat authorization as a session control problem, not a one-time access decision.
Session tokens, live data, and privilege escalation risk
The article’s session-token example shows how a single exposed credential can become an impersonation path when it is paired with active session context. For AI-driven workflows, the danger grows because the system may already have access to live data, API keys, private keys, or other privileged resources. Once those tokens are available, the issue is no longer whether the agent was authenticated. The issue is whether the session can be trusted to stay within its intended scope and whether the access path can be revoked before misuse spreads.
Practical implication: monitor session content and token exposure together, especially where agents can touch sensitive assets.
Orphaned AI agents create hidden governance debt
An orphaned AI agent is a running identity that no longer has an accountable owner or an active business purpose. That makes it different from a dormant account, because it can still access live systems while escaping normal review cycles. The governance failure is not just overprovisioning. It is that the identity lifecycle has drifted away from the operational lifecycle of the work it was built to do. When ownership ends but execution continues, the organisation loses visibility into whether the agent is still needed, still safe, or still authorized.
Practical implication: tie AI agent review and offboarding to the business project lifecycle, not just the technical deployment date.
Threat narrative
Attacker objective: The objective is to exploit exposed identity material or overbroad AI access to impersonate users, reach sensitive data, or trigger unauthorized actions.
- Entry occurs when sensitive data, session tokens, or privileged access are made available to an AI workflow that can operate on live systems.
- Escalation follows when the agent chains multiple functions together, moves beyond the original task boundary, or acts on assets that exceed the intended scope.
- Impact emerges through impersonation, unauthorized data access, or ungoverned actions that can create breach exposure and non-compliance.
Breaches seen in the wild
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Gate-based authorization is the wrong control shape for AI agents: a single yes-or-no access decision was designed for sessions that stay within predictable human or machine intent. That assumption fails when the actor can dynamically chain actions, select tools, and continue making decisions after the gate has opened. The implication is not simply that more approvals are needed. It is that authorization must be evaluated at the point of action, not only at the point of entry.
Ephemeral AI behaviour creates identity governance blind spots: traditional review processes assume access remains stable long enough to be observed, certified, and remediated. An AI agent can move from authorised to unsafe within the same runtime path, so review cadences and recertification alone cannot prove control. Practitioners need to recognise that the governance object is the session plus its live context, not just the identity record.
Unowned agents are the AI version of privilege creep: when a project ends but the agent keeps running, access persists without a clear business owner or offboarding trigger. That is a lifecycle failure, not only an access misconfiguration. The practitioner takeaway is that AI identity governance must account for creation, task completion, and retirement as a single control plane.
Identity blast radius becomes the decisive metric for AI operations: the article repeatedly points to live data, session tokens, and privileged commands as the real risk surface. That means the question is not whether AI should be allowed to act, but how far it can move when it does. Teams that cannot bound blast radius at the session layer will not be able to defend autonomous or semi-autonomous workflows.
Authorisation and authentication have to be governed as separate questions: the article is correct to move beyond login success and ask what the identity can do after access is granted. In AI environments, access alone tells you very little about risk. The practitioner implication is that policy enforcement must follow intent, asset sensitivity, and runtime behaviour, not stop at identity proof.
What this signals
Identity blast radius is the right control lens for AI agents: once an agent can chain functions across live data, the most useful measure is how far it can move before a control intervenes. Teams should focus on constraining session scope, asset reach, and token exposure rather than treating authentication as the primary safeguard.
The governance gap is not that AI exists, but that many programmes still assume access is stable enough to certify after the fact. For AI workflows, access can change shape inside the same session, which pushes control enforcement closer to the point of action and away from periodic review.
For practitioners
- Define AI agent ownership and offboarding criteria Assign a named business owner, a technical owner, and a retirement trigger for every agent that can access live systems or customer data.
- Separate authentication from authorization reviews Review what the agent can do after access is granted, including session commands, tool use, and asset sensitivity, rather than treating login as the control outcome.
- Limit the blast radius of live-data agents Constrain the identities, tokens, and target assets that an agent can touch so a compromised session cannot pivot into customer data, API keys, or private keys.
- Inspect privileged sessions for abnormal commands Look for unexpected command sequences, rapid privilege changes, or access to unsupported actions inside sessions that should remain task-bound.
- Build runtime policy checks for AI actions Use policy decisions that evaluate intent, need, history, and asset criticality at the moment the agent acts, not only when it authenticates.
Key takeaways
- AI agents change the risk model because they can continue making access decisions inside a session, not just at login.
- Exposed session tokens and orphaned agents are practical examples of how AI workflows turn identity material into governance risk.
- The control answer is not a stronger gate alone, but tighter runtime authorization, ownership, and blast-radius limits.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article centers on agents chaining actions and crossing intended task boundaries. |
| ASI03 — Identity & Privilege Abuse | The article focuses on excessive access, token exposure, and privilege use inside agent sessions. | |
| Recommendation — Restrict agent tool permissions so runtime action chains cannot exceed approved task scope. Audit agent identity paths for privilege abuse and reduce session authority to the minimum required. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Exposed session tokens and impersonation risk are explicit in the source article. |
| NHI-05 — Overprivileged NHI | The article repeatedly warns about identities that can do too much once access is granted. | |
| NHI-10 — Human Use of NHI | The article distinguishes between human approvals and machine-run action chains in shared sessions. | |
| Recommendation — Protect session-bearing credentials and revoke any token that can be replayed or impersonated. Reduce agent privilege scope so live-data access cannot become broad operational control. Separate human approval paths from machine-executed actions to avoid treating agents like users. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is about governance decisions for AI that acts in production sessions. |
| Recommendation — Establish accountability for AI actions and define governance roles for runtime authorization decisions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core topic is whether entitlements and session actions remain properly authorised. |
| Recommendation — Review and enforce access permissions continuously when AI systems operate on live data. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The article highlights token exposure, impersonation, and resulting misuse of access. |
| Recommendation — Map token exposure to credential access and treat impersonation risk as a precursor to impact. | ||
Key terms
- AI Agent Guardrail: A guardrail is a control boundary that limits what an AI agent can access, invoke, or change. In practice it combines identity, authorisation, approvals, monitoring, and audit so the agent's behaviour stays inside an approved task rather than drifting into broader system access.
- Session Token Exposure: Session token exposure occurs when authentication tokens or session artifacts are stored, transmitted, or logged in places they should not be. Once exposed, they can function like reusable credentials. This makes them part of identity and access risk, not only application behaviour.
- Orphaned Agent: An orphaned agent is an AI or software identity that still has access but no longer has a clear human owner responsible for its governance. The risk is lifecycle drift, where the access remains active after role changes or departures, leaving accountability and revocation processes incomplete.
- Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org