AI agent identity governance needs an access graph to control risk

At a glance

What this is: This is an analysis of why AI agent identity governance requires an access graph, with the key finding that legacy IAM and posture tools do not provide the identity context needed to control agentic access.

Why it matters: It matters because AI agents can inherit human access, use their own service accounts, and reach sensitive data and tools at runtime, forcing IAM, IGA, PAM, and NHI teams to govern a blended identity model.

By the numbers:

• According to the 2024 Verizon DBIR, stolen credentials remain a top breach vector across modern environments.
• Industry reports cited in the article say agent identities often outnumber human identities by a factor of 45 to 1 or more.

👉 Read Veza's analysis of AI agent identity governance and access graphs

Context

AI agent identity governance is the discipline of controlling what an autonomous or semi-autonomous system can access, what data it can retrieve, and which tools it can invoke at runtime. The article argues that traditional IAM, IGA, CSPM, and DSPM controls were built for simpler identity and data models, not for agents that combine user context, service accounts, external tools, and retrieval systems.

The gap is not just more access. It is that an agentic workflow can expand the security boundary across training data, inference-time retrieval, MCP connections, and downstream action execution in a single operating chain. That makes the access graph central to AI security posture because practitioners need visibility into effective permissions, not just assigned entitlements.

This is a NHI problem first, but it also intersects with human delegation and autonomous behaviour when agents act on behalf of users or request additional permissions mid-run. The article’s starting point is typical of current enterprise AI adoption, where governance lags deployment and access sprawl grows faster than policy coverage.

Key questions

Q: How should security teams manage permissions for AI agents?

A: Security teams should regularly assess and update the permissions granted to AI agents to ensure they align with their intended scope. Implementing a governance framework that details access levels and usage policies is crucial to mitigate risks. Moreover, continuous monitoring can detect irregular permissions that may increase exposure.

Q: Why do AI agents create new access risk for enterprises?

A: AI agents create access risk because they can operate with delegated authority while processing untrusted inputs. If prompts, tools, or permissions are abused, the agent may expose data or trigger actions faster than a human reviewer can intervene. The risk is not only compromise, but overreach built into the design.

Q: What breaks when CSPM and DSPM are used alone for AI security?

A: They can identify misconfigurations and sensitive data, but they do not tell you which agent can act on that data or which tool chain can reach it. Without identity context, teams may know where the data is, but not who or what can use it.

Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?

A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.

Technical breakdown

Why legacy IAM and IGA fail for agentic access

Traditional IAM and IGA are structured around stable identities, predictable lifecycle events, and reviewable entitlements. AI agents break that model because they can inherit user permissions, rely on their own service accounts, and change the data or tools they touch as tasks evolve. That makes effective permission computation harder than simple account provisioning. The security question is no longer only who is logged in, but what the agent can do across data, model, and tool boundaries at the moment of execution.

Practical implication: map effective permissions for each agent across identity, data, and tooling layers instead of relying on human-oriented access review logic.

How MCP connections expand the attack surface

Model Context Protocol connections give agents structured access to external tools and data sources, but they also create a new trust boundary. A compromised or malicious MCP server can feed tainted context, expose over-permissioned tools, or drive an agent toward unsafe actions. In practical terms, the MCP bridge is not just an integration layer. It becomes an authority path that can broaden agent capability beyond what security teams intended if the connected services are not governed as part of the identity plane.

Practical implication: treat each MCP connection as a governed privilege path with approval, inventory, and revocation controls.

Why an access graph is the right control model

An access graph is a relationship model that connects identities, data sources, models, service accounts, and external tools into one queryable view. For agentic environments, that matters because permissions are distributed across many systems and are often inherited rather than explicit. The graph lets teams answer practical questions such as who can take what action on what data, and it can surface hidden dependency chains that conventional point tools miss. That makes it a control plane for least privilege, not just a reporting layer.

Practical implication: build governance around graph-based authorization evidence so you can trace agent permissions before deployment and during runtime.

Threat narrative

Attacker objective: The attacker wants to turn trusted AI automation into a high-privilege execution path for data theft, unauthorized actions, or broader compromise.

1. Entry occurs when attackers exploit model supply chains, compromised integrations, or over-permissioned AI connectors to reach agent workflows and associated data.
2. Escalation follows when the agent inherits broad user context or service-account access, allowing the attacker to expand from prompt-level influence into tool use and data retrieval.
3. Impact is achieved when the agent performs unauthorized actions, exposes sensitive records, or moves data through trusted AI pathways that defenders did not model as attack surfaces.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent identity is now a blended governance problem, not a single-control problem. The article shows that agents can operate with inherited human permissions, standalone service accounts, and external tool access in the same workflow. That means least privilege must be evaluated across identity, data, and execution paths together. Practitioners should treat agent governance as an access-model problem, not a standalone AI tooling issue.

Access graphs are becoming the only workable way to govern agentic least privilege at scale. Relational IAM databases were built for stable accounts and comparatively bounded entitlement sets. Agentic systems create a far denser web of relationships across models, data pipelines, and tools. Identity blast radius: this is the practical limit of what an agent can touch once its effective permissions are assembled from multiple systems. Security teams should design for graph-based evidence, not spreadsheet-based review.

Legacy posture tools miss the security question that matters most for AI. CSPM can find misconfigurations and DSPM can locate sensitive data, but neither can explain which agent, model, or connector can act on that data. The article’s core contribution is to show that access context is the missing layer. Practitioners should reframe AI security from asset discovery alone to permission lineage and actionability.

Shadow AI will become a governance problem before it becomes a detection problem. The article describes decentralized adoption of agents and models that escape central oversight. That means security teams may discover risk only after the agent has already been deployed and connected to data. The practical implication is that inventory without authorisation context is incomplete, and visibility without entitlement lineage does not produce control.

AI security posture management should be judged by whether it can answer 'who can take what action on what data?' across the full agentic lifecycle. That question bridges human delegation, NHI governance, and runtime access in one frame. It is the right test for whether an AI security programme is actually governing identity or merely cataloguing assets. Practitioners should use that question as the baseline for AI governance design.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For a deeper governance baseline, see OWASP NHI Top 10 for the controls that matter most when agents can select tools and data paths at runtime.

What this signals

With 98% of companies planning to deploy more AI agents within the next 12 months, the governance gap is widening faster than review cycles can catch up. Practitioners should assume that the next wave of risk will come from scale, not from a single novel exploit, so access lineage and entitlement evidence need to be built into deployment workflows now.

Identity blast radius: in agentic environments, the practical security question is no longer whether an agent exists, but how far it can reach. Teams that can trace permissions through the 52 NHI Breaches Analysis and their own access graph will be better positioned to contain both accidental overreach and malicious compromise.

This topic also reinforces why the OWASP Agentic AI Top 10 matters operationally. If security teams cannot explain which identities, tools, and data sources are linked to an agent, then they cannot confidently prove least privilege, auditability, or containment.

For practitioners

• Inventory every agent and connector with identity context Build a complete inventory of models, agents, service accounts, data sources, and MCP connections, then record which identity each one uses and what data it can reach.
• Compute effective permissions before deployment Do not rely on declared roles or static entitlements. Recalculate what each agent can actually do across identity providers, cloud platforms, data systems, and SaaS integrations.
• Treat MCP servers as governed privilege paths Require approval, ownership, and revocation for every MCP connection, and validate whether the server can expose tools or context beyond the intended task scope.
• Separate human delegation from autonomous runtime access Document when an agent is acting under inherited user permissions versus independent machine identity, because those two models need different controls and review evidence.
• Use least privilege to limit agent blast radius Constrain each deployed agent to the minimum systems and data it needs, and make blast-radius queries part of incident response and access review.

Key takeaways

• AI agents expand identity governance into a blended model where human delegation, machine identities, and external tools must be controlled together.
• Legacy IAM, IGA, CSPM, and DSPM can expose parts of the problem, but they do not answer the core authorization question for agentic systems.
• An access graph gives practitioners the evidence needed to map effective permissions, reduce blast radius, and govern AI agents before they become shadow infrastructure.

Key terms

• Access Graph: An access graph is a relationship model that links identities, permissions, data objects, and system interactions. In NHI governance, it helps security teams see the full path from an agent or user to the action it can take, which is more useful than isolated account reviews.
• AI Security Posture Management: A governance approach for discovering and tracking AI assets such as models, agents, datasets, vector stores, and related infrastructure. It becomes useful only when inventory is connected to runtime exposure and the identity that can actually reach the data.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Veza's full article covers the operational detail this post intentionally leaves for the source:

• How the access graph is structured across identity providers, cloud platforms, SaaS apps, and data systems
• The article’s full discussion of AI Security Posture Management as a governance model for agentic workflows
• Specific examples of how runtime permissions and data lineage are queried in practice
• The article’s framing of shadow AI discovery and model compliance as an operational workflow

👉 Veza's full article covers the access graph model, agentic lifecycle governance, and runtime permission examples

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.