AI agent identity governance now hinges on revocation and runtime enforcement

At a glance

What this is: NHI Mgmt Group's analysis, drawing on AppViewX's blog post: AI agent identity is moving from discovery to runtime control because visibility alone cannot constrain autonomous privileges.

Why it matters: This matters because identity teams need controls that can issue, scope, rotate, and revoke agent privileges as runtime behaviour changes, not after an incident exposes the gap.

Context

AI agent identity is now a governance problem, not just a visibility problem. Discovery creates an inventory, but inventory alone does not limit what an autonomous agent can do once it starts invoking tools, touching data, and chaining actions across systems.

The underlying assumption that access can be reviewed after it is granted breaks down when the identity is runtime-driven and the privilege can change during execution. That makes agent lifecycle management, revocation, and runtime enforcement part of the control plane rather than an after-the-fact audit task, especially when agents move through MCP-enabled workflows.

Key questions

Q: How do AI agent identities work in enterprise systems?

A: AI agent identities are non-human identities assigned to software that can act on behalf of a business process, call tools, and interact with systems under delegated access. The governance challenge is that those identities often need to be issued, scoped, monitored, rotated, and retired like any other machine identity, but with tighter runtime control because behaviour can change during execution.

Q: Why does discovery not solve AI agent identity risk?

A: Discovery only tells you an AI agent exists and what it can see at a point in time. Identity risk comes from runtime authority, so teams need runtime enforcement and revocation for the agent’s tokens, service accounts, tool grants, and approval paths, plus a named human owner who can disable access when the agent’s scope changes or misbehaves.

Q: What is the difference between machine identity and AI agent identity?

A: Machine identity is the broader technical identity used by software systems to authenticate and authorize access. AI agent identity is a subtype that also needs constraints on tool use, action scope, and rollback because the agent can make decisions and trigger downstream actions. Agent identity therefore needs tighter behavioural controls than a standard workload identity.

Q: How should teams revoke AI agent access after decommissioning?

A: Revoke AI agent access by disabling the agent account, expiring or deleting its credentials, tokens, connected service accounts, and certificates, then removing any OAuth grants, API permissions, and tool registrations. You should also rotate any shared secrets, invalidate cached sessions, and confirm the human owner has closed the agent’s authority in PAM or IAM records.

Technical breakdown

Why discovery is not control for AI agent identity

Discovery tells you which agents exist, what credentials they have, and where they are active. Control is different: it determines whether an agent can continue acting when policy changes, scope drifts, or behaviour becomes unsafe. For autonomous actors, the problem is not merely inventory but runtime authority, because an agent can hold valid access while behaving unpredictably across systems. That makes visibility a prerequisite, but not a containment mechanism. See the Shadow AI and AI Agent Discovery Guide.

Practical implication: Treat discovery as the starting point for governance, not the point at which risk is resolved.

How runtime enforcement constrains autonomous privilege

Runtime enforcement applies policy at the moment an agent tries to act, rather than only at issuance time. In practice, that means the authorisation decision must stay live as the agent requests tools, data, or downstream actions. This is different from static provisioning because the relevant question is not whether access existed, but whether it should still exist at that exact moment. The architecture has to handle non-deterministic behaviour without assuming a fixed workflow. See the AI Agent Authorisation Guide.

Practical implication: Use task-scoped enforcement so agent privileges can be narrowed or blocked while the session is still active.

Why lifecycle management must include revocation and retirement

Agent lifecycle management is about the full identity arc: issue, operate, rotate, revoke, and retire. The failure mode is residual access, where credentials, tokens, or connected service accounts remain valid after the agent is no longer supposed to use them. In an agent estate, that leftover access is especially dangerous because agents can generate and consume credentials quickly, leaving stale permissions behind faster than manual reviews can catch them. The control objective is to make offboarding a normal identity event, not an exceptional cleanup task. See the Agentic AI Identity Guide.

Practical implication: Automate offboarding so decommissioned agents cannot keep authenticating through orphaned credentials.

Threat narrative

Attacker objective: The attacker seeks to inherit or misuse agent credentials and standing access so they can act through the compromised identity without breaking authentication.

1. Entry occurs when an agent is issued valid credentials and begins operating with real privileges across enterprise systems.
2. Escalation happens when the agent's runtime behaviour exceeds the scope originally assumed by the governance model, especially if policy drift is not caught in-session.
3. Impact follows when stale access or unchecked privilege lets the agent act beyond its intended role until an incident forces revocation.

Breaches seen in the wild

• postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.
• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Discovery is only a registry function, not a governance function. The market still overstates the value of visibility because an inventory does not constrain action. Once an autonomous agent can invoke tools and operate across systems, the control question becomes whether its privileges can be changed or stopped in real time.

Agent identity breaks the assumption that access is stable long enough to review. Access review and recertification processes were designed for identities whose privileges persist across a review cycle. That assumption fails when an autonomous actor can acquire, use, and discard permissions within a short operational window, so the governance model itself needs rethinking.

Residual access is the real failure mode in agent estates. The dangerous part is not initial issuance but the persistence of credentials, tokens, and service connections after the agent has been moved, replaced, or shut down. That is why revocation and retirement have to be treated as first-class identity events, not housekeeping.

AI agent identity governance is converging with machine identity governance. The same cryptographic trust issues that affect certificates and machine credentials now apply to agents that authenticate, call APIs, and move through delegated workflows. The practical implication is that identity programmes will need one operating model for workload and agent lifecycles, not separate silos.

Visibility-first products will remain incomplete until they can enforce policy. A registry can help teams understand the estate, but it does not answer the harder question of what happens when behaviour deviates. The decision point for practitioners is whether a platform can narrow access at runtime and revoke it when the agent outlives its purpose.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Runtime control will become the differentiator in agent governance. As agent estates expand, organisations will move from asking whether they can find agents to asking whether they can stop them mid-session. The next maturity step is policy enforcement that can act on live behaviour, not just catalogue it.

Residual access will remain the most stubborn failure mode. Agents that generate credentials quickly will outpace manual review unless lifecycle offboarding is automated end to end. Programmes that still rely on periodic cleanup will keep discovering stale access only after it has already been used.

Identity teams should expect agent governance to merge with machine-identity operations. The operational model will increasingly resemble workload identity management, where cryptographic trust, ownership, and revocation sit in the same control loop. That convergence will matter most for programmes that already manage certificates, tokens, and service accounts at scale.

For practitioners

• Implement runtime policy enforcement for agents Enforce least-privilege decisions at the moment an agent requests tools or data, not only when it is created.
• Automate agent revocation and retirement Remove credentials, tokens, connected service accounts, and policy bindings as part of decommissioning, not as a manual cleanup step.
• Track agents with an identity inventory Maintain a central registry that links each agent to its credentials, owners, runtime scope, and connected systems.
• Test for scope drift during active sessions Validate whether an agent can keep acting after its task context changes or its initial authorization no longer fits the job.
• Review cryptographic agility for agent credentials Confirm that agent-issued certificates and keys can be rotated or migrated without disrupting active identity operations.

Key takeaways

• AI agent identity is no longer just an inventory problem, because autonomous behaviour can outgrow the static assumptions behind ordinary access governance.
• The article points to a shift toward runtime enforcement and lifecycle revocation as the controls that matter once agents carry real privileges.
• Programmes that cannot stop, scope, and retire agent identities in session will treat visibility as progress while leaving the underlying risk untouched.

Related NHI Mgmt Group resources: Agentic AI Identity Guide · Shadow AI and AI Agent Discovery Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide

Key terms

• AI Agent Identity: The digital identity used by an autonomous AI agent to authenticate to external systems, APIs, and services. Managing AI agent identities is an emerging and rapidly evolving area of NHI security.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Agent Lifecycle Management: The process of provisioning, governing, updating, and retiring an AI agent or other non-human identity. It includes credential issuance, permission changes, logging, rotation, and offboarding. Without lifecycle control, agents can retain access after their business purpose ends, creating persistent risk.
• Residual Access: Residual access is any permission, token, account, or data path that continues to work after a user should no longer have access. It is a common failure mode in SaaS-heavy environments because deprovisioning one system does not automatically shut down all downstream connections.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.