TL;DR: AI agents are gaining autonomy and acting on behalf of users, but most identity and authentication systems were built around a human at the keyboard, according to Stytch. Extending OAuth-style delegation, auditable consent, and ephemeral credentials becomes a governance problem, not just an integration choice, because existing trust models assume direct user interaction and stable approval flows.
At a glance
What this is: Stytch argues that AI agents break assumptions in existing auth models by adding a layer of delegation, consent, and access control that human-centred identity systems were not designed to govern.
Why it matters: IAM and security teams need to treat agent access as a distinct governance problem because consent, delegation, and data-sharing boundaries change once software can act on behalf of a user.
Context
AI agent identity is the problem of how software that acts on behalf of a user proves who it is, what it may do, and how consent is recorded. The old model assumes a person is present to click, approve, and absorb risk, which breaks once an agent starts initiating actions on its own.
This post is about the gap between human-centred authentication and agent-driven access. The article also brings MCP servers into scope as a way to expose application data to agents, which makes delegation and consent design part of the identity architecture rather than a separate integration concern.
For identity programmes, the practical issue is not whether agents can use existing auth protocols, but whether those protocols still express accountability, scope, and revocation cleanly when the actor is no longer the human user.
Key questions
Q: How should security teams handle delegated access when AI agents act on behalf of customers?
A: Security teams should treat delegated access as a separate governance layer, not as a normal login session. Define what the agent can do, how much value it can move, which approvals are required, and how delegation is revoked. Without those boundaries, the agent inherits more authority than the customer intended and fraud risk expands quickly.
Q: Why do human-centred consent models fail for AI agents?
A: They assume the approving person is present for the full decision chain. Agents can continue acting after the moment of approval, which means the original prompt or consent screen no longer fully describes the action path, the risk, or the accountability boundary.
Q: When does ephemeral credentialing reduce risk for AI agents?
A: Ephemeral credentialing reduces risk when it is tied to narrow task scope, automatic expiry, and continuous policy checks. If the agent can still reach too many systems during the valid window, the trust problem remains. Short-lived access shrinks exposure time, but it does not replace least privilege or intent validation.
Q: What should teams do when exposing application data to MCP servers for agents?
A: Treat the MCP server as a governed exposure point, not just a technical connector. Define which data is reachable, which scopes an agent may request, what consent evidence is stored, and how the delegation is revoked if the use case changes.
Technical breakdown
Why human-centred auth models struggle with AI agents
Traditional authentication and consent flows assume a direct user interaction pattern: a person logs in, sees a prompt, and approves a request in real time. That model works when identity, intent, and approval are tightly coupled to the session. AI agents insert a delegation layer that can separate the user from the action, making it harder to tell who initiated a request, who approved it, and what scope was truly intended. The result is not just a UX problem, but a trust-boundary problem that identity architecture has to represent explicitly.
Practical implication: Model agent access as delegated authority with explicit scope, not as a disguised human login flow.
How OAuth-style delegation changes for agent access
OAuth-style delegation remains the closest fit for many agent use cases because it already expresses one identity granting another limited access. The difference is that agents may chain multiple actions after the initial consent event, and those actions can occur outside the original UI moment. That means the consent record has to be durable, auditable, and specific enough to survive later review. In practice, the protocol may remain the same while the governance around consent receipts, token scope, and issuer trust becomes far more important.
Practical implication: Use OAuth only where scopes, token lifetime, and consent records remain reviewable after the agent has started acting.
What ephemeral credentials and consent receipts add to agent governance
Ephemeral credentials reduce the blast radius of agent access by shrinking the lifetime of what the agent can use. Consent receipts do something different: they preserve evidence of what was approved, by whom, and for what purpose. Together, these primitives address two separate failures in agent identity design. One is overlong access. The other is missing accountability. Without both, teams can end up with valid tokens and no durable proof of why the agent received them, which weakens both security and auditability.
Practical implication: Treat token lifetime and consent evidence as separate controls, then verify both during design review.
Threat narrative
Attacker objective: Obtain delegated access that can be used to operate on sensitive application data while preserving the appearance of legitimate user consent.
- Entry occurs when a user grants an agent delegated access through an OAuth-style consent flow tied to an MCP server or similar tool surface.
- Escalation happens when the agent can chain multiple actions beyond the original user moment, expanding the practical scope of the delegated authority.
- Impact is the agent’s ability to read or act on application data on the user’s behalf without a clear, durable record of who approved each downstream action.
Breaches seen in the wild
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI agent identity creates an assumption collapse in human-centred auth: existing consent models were designed for a user who is present, aware, and able to approve each action at the moment it happens. That assumption fails when the actor is an agent because the action chain can extend beyond the approval moment and the human may never see the full sequence. The implication is that identity governance has to account for delegated runtime behaviour, not just login-time approval.
Consent is becoming a governance object, not just a UX step: once agents can act across applications, the real security question is whether consent can be audited, scoped, and revoked independently of the session that created it. That matters for both human IAM and NHI governance because the same lifecycle issue appears whenever one identity is permitted to operate through another. Practitioners need to treat consent records as first-class evidence of authority.
OAuth remains useful, but only as one layer in an agent identity stack: the protocol can express delegation, yet it does not by itself solve purpose limitation, durable consent evidence, or safe revocation for agent-initiated actions. That gap will widen as more software exposes data to agents through MCP-style interfaces. Teams should expect the control plane to move upward from authentication into policy, issuance, and audit.
Ephemeral credential design is a named control gap, not a nice-to-have: long-lived tokens make agent access harder to justify, harder to inspect, and harder to contain when the delegated purpose changes mid-session. The article points to a future where access must be short-lived enough to match the task and traceable enough to support accountability. That should push identity programmes toward purpose-bound issuance and tighter token lifecycle governance.
Agent-ready architectures will force IAM, platform, and application teams to share the same trust model: if the application, MCP server, and identity provider each make different assumptions about who controls the action, consent becomes fragmented and the audit trail breaks. This is where cross-domain identity governance matters most. Practitioners should align delegation semantics before they scale agent access across the estate.
From our research library:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Authorisation Guide
What this signals
Agent-ready identity will push governance upward: the control problem is shifting from who can sign in to who can delegate, what they can delegate, and how that delegation is proven later. IAM teams should expect policy, consent, and issuance to converge around the agent session rather than around the user account.
Consent receipts will matter more as agent usage expands: once a delegated action can unfold over multiple tools and sessions, the organisation needs evidence of the original approval, not just a valid token. That makes consent an audit artefact, not a UI step.
OAuth-style delegation remains useful, but only when the programme can bound duration and purpose: without short-lived credentials and tightly scoped access, agent access becomes indistinguishable from broad standing privilege. Teams should treat that as a design failure, not an integration compromise.
For practitioners
- Define agent-specific consent boundaries Separate human login from agent delegation so the approved scope, purpose, and downstream action set are explicit and reviewable.
- Issue short-lived credentials for agent sessions Prefer ephemeral credentials that expire with the task, not broad tokens that remain valid after the immediate agent interaction ends.
- Record durable consent receipts Store who approved the delegation, what scope was granted, and which application or MCP server received it so audit teams can reconstruct the decision.
- Map MCP exposure to identity policy Treat MCP servers as governed data exposure points and verify that each server’s access model matches the identity and consent rules applied to agents.
- Review revocation paths for delegated access Test whether you can withdraw an agent’s authority without breaking the user account, the application, or the data-sharing workflow.
Key takeaways
- AI agents expose a structural mismatch between human-centred auth flows and delegated machine action, especially when approval and execution are no longer adjacent.
- The main governance gap is not whether delegation is possible, but whether the organisation can prove scope, purpose, and revocation after the fact.
- Short-lived credentials and durable consent evidence are the two controls that most directly change the risk profile of agent access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centers on agent identity, delegated authority, and misuse of granted privileges. |
| Recommendation — Constrain agent privilege boundaries and verify delegated authority before any downstream tool action. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The post examines how auth assumptions fail when agents are not human users. |
| NHI-10 — Human Use of NHI | The article describes humans granting agent access that operates on their behalf. | |
| Recommendation — Redesign authentication flows so agent identity is explicit and not confused with human login state. Separate human approval from non-human execution and record the delegation boundary clearly. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Ephemeral credentials and token lifecycle are central to the article's control model. |
| Recommendation — Apply authenticator lifecycle controls to limit how long delegated agent credentials remain usable. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The threat pattern involves stealing or abusing tokens obtained through consent flows. |
| Recommendation — Monitor consent and token issuance paths for credential access patterns that indicate delegated abuse. | ||
| NIST Zero Trust (SP 800-207) | 5.2 — Continuous Access Evaluation | Agentic access benefits from continuous validation rather than one-time approval. |
| Recommendation — Use continuous access evaluation to recheck delegated agent authority as context changes. | ||
Key terms
- Agent Delegation Chain: A delegation chain is the sequence of agents that pass tasks, context, or actions to one another before work is completed. In governed systems, each hop becomes a security boundary because identity, authority, and accountability can change as the task moves downstream.
- Consent Receipt: A consent receipt is the record that proves what a customer agreed to, when they agreed, and under which policy text. In identity governance, it must be durable, versioned, and linked to the identity event so later audits or disputes can reconstruct the decision accurately.
- Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
- MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org