TL;DR: AI agents can request and use access in ways that exceed their original provisioning, and Fiddler’s article argues that existing permission models, bearer tokens, and static grants are not designed for that behaviour. The core issue is assumption collapse: access review and fixed-scoping models presume stable permissions, while agents can seek new access mid-task and expose secrets through context.
At a glance
What this is: This article argues that AI agents are breaking existing permission models because they can request new access mid-task, amplify over-privilege, and expose credentials through context.
Why it matters: IAM, PAM, and NHI programmes need to treat agent identity as a design problem, because static grants and review cadences do not match runtime permission expansion.
Context
AI agent identity is the problem of how a reasoning machine gets, uses, and changes access while it is executing work. Existing permission models assume access is provisioned once and then reviewed later, but agents can ask for new permissions mid-task and operate at machine speed.
That creates an identity governance gap across agentic AI, NHI, and broader IAM programmes. If credentials can be expanded, discovered, or exposed during execution, then the control point shifts from post-issuance review to issuance-time policy and context-aware enforcement.
Key questions
Q: What breaks when AI agents have broader access than their tasks require?
A: Over-privileged agents break segregation of duties, weaken auditability, and expand blast radius across transactions, data lookups, and workflow triggers. In banking, a single agent identity can act with more operational reach than any human reviewer can safely justify.
Q: Why do static secrets create more risk for AI agents than for traditional workloads?
A: Static secrets create more risk for AI agents because agents act autonomously, at high speed, and often across multiple systems. A copied token or certificate can be replayed long after issuance, while the agent may already have chained actions elsewhere. The longer the credential lives, the larger the attack window and the harder attribution becomes.
Q: What are the signs that an AI agent permission model is failing in practice?
A: Common signs include agents requesting access beyond their role, attempting sensitive actions without clear approval, or operating with no audit trail for who approved what. Another warning sign is when the workflow cannot pause before execution. If teams cannot explain, review, and reconstruct decisions, the permission model is not controlling agent behavior well enough.
Q: How should teams govern access when AI agents and service accounts share the same business systems?
A: Treat them as different identity subjects with the same governance obligation. Create one access model that covers ownership, entitlement scope, review cadence, and offboarding across human and non-human identities, then apply role-appropriate controls to each class. The goal is not separate programmes. It is one risk model that can follow access across systems and workflows.
Technical breakdown
Why fixed permission grants fail for AI agents
Traditional machine identity assumes a workload is provisioned with a known scope and then stays within it. AI agents break that assumption because reasoning changes what they may request during execution, not just what they can do after provisioning. In practice, that means a permission model built for stable workloads becomes a moving target once the actor can decide it needs another system, another dataset, or another token mid-session. The failure is architectural, not just procedural: the model no longer matches the actor's behaviour.
Practical implication: Practitioners need to treat runtime permission expansion as a design constraint, not an edge case.
Why bearer tokens and LLM context create identity exposure
Bearer tokens are possession-based credentials, so whoever has the token can use it, regardless of whether the holder is the intended agent. If those secrets enter the model context, they can be surfaced accidentally in output or deliberately through prompt injection. The deeper issue is that the LLM context becomes an unsafe trust boundary for credentials, because the model is both processing data and participating in action selection. Proxy-mediated issuance keeps the credential out of the reasoning layer and reduces the chance that context becomes a theft channel.
Practical implication: Keep secrets out of agent context and issue short-lived credentials through an enforcement point.
How dynamic authorisation changes the control plane
The article describes a split between policy decision and policy enforcement. The policy decision point evaluates whether a new request aligns with the human principal's intent, guardrails, and current context, while the resource server enforces the approved scope. That pattern matters because it turns access from a static grant into a just-in-time decision. For AI agents, this is less about convenience and more about making authorisation responsive to runtime behaviour without handing over standing privilege.
Practical implication: Move authorisation closer to the action and require scoped, task-specific approval for new access requests.
Threat narrative
Attacker objective: The objective is to steer an agent's behaviour or harvest its reachable credentials so access expands beyond the original grant.
- Entry occurs when a user or system grants an AI agent access to data, tools, or a local environment that contains sensitive credentials or broad file access.
- Credential exposure follows when recovery codes, bearer tokens, or API keys are available inside the agent's reachable context or file system.
- Escalation happens when the agent requests additional access mid-task or uses exposed credentials to complete actions outside the original scope.
- Impact is the unauthorised expansion of machine access, secret leakage, and redirected behaviour through prompt injection or over-broad delegation.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Access review is not a sufficient control when the actor can expand privilege mid-task: review cadences assume access persists long enough to be observed, certified, and revoked. AI agents can request additional permissions during execution, which means the thing being reviewed may not be the thing that was originally granted. The implication is that governance must shift from static entitlement review to runtime authorisation boundaries.
Credentials must not enter LLM context because context is an attack surface, not a safe workspace: once a secret is readable by the agent, it is also reachable by prompt injection, accidental leakage, and policy failure. That changes the trust model for bearer tokens, recovery codes, and API keys. The implication is that secret handling for agents is now an identity design problem, not just a secrets-management problem.
Permission models built for stable workloads collapse when reasoning becomes part of the access request: least privilege is no longer something you can fully define at provisioning time if the actor can discover new tasks mid-session. That is a broken premise, not merely a weak implementation. The implication is that identity governance has to account for intent drift, not only privilege scope.
Dynamic authorisation is becoming the baseline control pattern for agentic systems: the meaningful security decision is no longer whether an agent has an account, but whether each new action is evaluated against original intent and current context before execution. This pushes identity, observability, and policy enforcement into the same control plane. Practitioners should expect access governance to converge on task-scoped issuance rather than standing grants.
Agent identity will force convergence across IAM, NHI, and AI governance teams: the same control failures show up as over-privileged permissions, leaked credentials, and unbounded delegation. Treating these as separate problems creates blind spots that agents exploit by design. The implication is that identity architecture for AI agents should be governed as a cross-domain discipline, not a point solution.
From our research library:
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
- Read next: AI Agent Authorisation Guide
What this signals
Agent identity creates an intent problem, not just an authentication problem: a reasoning system can change what it wants access to while it is already operating, so entitlement cannot be treated as a one-time provisioning event. That pushes governance toward just-in-time authorisation and away from standing privilege.
Secret exposure becomes a control-plane failure when credentials are visible to the model: once tokens or recovery codes are inside the LLM context, the agent can accidentally or deliberately reveal them, and prompt injection becomes an identity issue rather than only a content-safety issue.
Governance programmes built on access review cadences assume that privilege persists long enough to be observed, logged, and certified. When the actor is autonomous, that window collapses to within-session, and existing review cycles have no trigger, no artefact, and no remediable state to act on.
For practitioners
- Define runtime permission boundaries Map where AI agents are allowed to request new access during execution and where they must stop and re-authenticate against policy.
- Keep credentials out of model context Route secrets through proxies or gateways so bearer tokens, recovery codes, and API keys never appear in LLM prompts or outputs.
- Shorten credential lifetime for agent use Prefer short-lived OAuth access tokens with narrow scope for tasks that need delegated access, especially where the agent can act autonomously.
- Instrument agent permission requests Log every mid-task access request, compare it with original intent, and alert on scope expansion or unusual approval patterns.
- Review local execution assumptions Treat laptops and other local environments as high-risk because agent processes can read downloads folders, dot files, and cleartext tokens unless blocked.
Key takeaways
- AI agents expose a structural mismatch in existing permission models because they can request new access while executing work.
- Bearer tokens, recovery codes, and other secrets become higher-risk when they can enter model context and be influenced by prompt injection.
- The governance response is to move toward runtime authorisation, short-lived credentials, and tighter control of what the agent can ever see.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centers on agents expanding or misusing access during execution. |
| Recommendation — Apply ASI03 to constrain agent privilege to task-scoped, policy-evaluated actions. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The post stresses agent identity, bearer tokens, and proof-of-possession gaps. |
| NHI-05 — Overprivileged NHI | The article explicitly says most permissions are already over-privileged and agents amplify that exposure. | |
| Recommendation — Use NHI-04 to replace broad bearer grants with stronger identity-bound access checks. Use NHI-05 to reduce standing access and narrow every agent entitlement to the minimum task scope. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is how access is granted, expanded, and enforced for AI agents. |
| Recommendation — Align agent access governance to PR.AA-05 by enforcing authorisation at the point of use. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes secret exposure and scope expansion as the main threat pattern. |
| Recommendation — Map agent secret exposure and scope expansion to TA0006 and TA0008 in detection and response planning. | ||
Key terms
- Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.
- Dynamic Authorization: Dynamic authorization is an access model that makes the trust decision at request time using current identity and context. It replaces reusable stored credentials with short-lived, policy-scoped tokens issued only after the workload proves itself.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Bearer Token: A bearer token is a credential that grants access to whoever possesses it, without requiring strong proof that the holder is the intended client. In NHI environments, that makes theft and replay the main risk, especially when tokens are long-lived, broadly scoped, or stored in local files.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org