AI agent identity risk outpaces existing IAM controls and governance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Okta's blog post: AI agent identity risk is rising because agent behaviour, app-to-app delegation and long-lived secrets are straining existing IAM and governance controls.

Why it matters: IAM, IGA, PAM and NHI teams need a shared control model for AI agents because the access path, consent model and credential form factor all shift at runtime.

Context

AI agents are software systems that can plan, execute and iterate across applications, but they authenticate through familiar non-human identity patterns such as service accounts, passwords, API tokens and OAuth tokens. The governance problem is not the presence of tools alone. It is that the identity layer was built for more predictable access paths than many agentic workflows now create.

Okta’s article frames three practical pressure points: visibility loss, delegated trust and long-lived secrets. Those are classic identity control themes, but the combination of runtime variability and app-to-app chaining makes them harder to govern with conventional IAM, PAM and access review processes.

For identity teams, the question is no longer whether AI introduces a new category of control. It is how quickly current NHI governance, consent handling and secret management can be adapted before agent-driven access becomes normalised outside policy.

Key questions

Q: What breaks when identity governance does not cover AI agents and service accounts together?

A: Governance breaks at the boundary between approved access and actual execution. If service accounts, AI agents, and humans are managed separately, organisations lose the ability to trace accountability across the full delegation chain and miss privilege that persists beyond its intended scope.

Q: Why do AI agents increase the risk of third-party access sprawl?

A: Because they inherit permissions through OAuth grants, integrations, and embedded SaaS features that were often approved for convenience. Once an agent can chain actions, persistent access becomes blast radius. The risk is not the model alone. It is the combination of delegated identity, over-scoped access, and weak offboarding discipline.

Q: What are the warning signs that agentic access is becoming ungoverned?

A: Common warning signs include users creating app-to-app connections outside central review, repeated use of persistent tokens, and agents reaching sensitive resources that security teams cannot easily enumerate. If the organisation cannot explain who approved the connection, what scopes were granted and which resources are reachable, governance is already lagging.

Q: How should teams balance user consent and administrator control for AI agents?

A: User consent should not be the default approval path for sensitive data or crown-jewel systems. Teams should reserve higher-risk connections for administrator-controlled review, apply policy to app-to-app links, and document which scenarios can never be self-authorised. That keeps consent from becoming an unmanaged shadow governance layer.

Technical breakdown

Why AI agent identities behave differently from service accounts

AI agents are not just another automated workload. The article describes them as systems that plan, execute and iterate across applications, which means identity is tied to changing task context rather than a fixed function. They still authenticate with familiar NHI artefacts such as service accounts, API tokens and OAuth tokens, but their behaviour is non-deterministic. That matters because existing IAM patterns assume a more stable relationship between identity, purpose and access scope than agentic systems can guarantee.

Practical implication: classify agent identities separately from standard workload accounts when access scope can expand during runtime.

App-to-app delegation and consent create a hidden trust chain

The article’s delegation example shows how one user-approved connection can let one application access another on the user’s behalf. This is not only an authorisation issue. It is a trust-chain problem, where consent, scopes and downstream app connections create paths that security teams may not have approved centrally. When end users can initiate these links, the governance boundary shifts away from administrator-controlled access design and toward unmanaged consent decisions.

Practical implication: move app-to-app consent and crown-jewel access into centrally governed approval and review workflows.

Long-lived secrets remain the easiest way for agents to overreach

The article links agentic use cases to increased reliance on long-lived secrets, especially when connecting to MCP servers or other SaaS tools. That reintroduces the oldest NHI failure mode: durable credentials that are easy to copy, leak and reuse. If an agent can operate only because a static token is available, then the access path is no longer constrained by session boundaries or explicit issuance events. In practice, the credential becomes the real control plane.

Practical implication: reduce static secret dependence for agent integrations and treat every persistent token as a high-risk access path.

Threat narrative

Attacker objective: The attacker aims to induce the agent into disclosing sensitive corporate data or abusing delegated access across linked systems.

1. Entry begins when an employee connects an AI agent to enterprise applications using service accounts, passwords, API tokens or OAuth tokens.
2. Escalation occurs when the agent’s non-deterministic behaviour expands its access path across multiple applications and connected resources.
3. Impact follows when a misused or tricked agent leaks sensitive data, especially where the same LLM is linked to both internal financial resources and an external server.

Breaches seen in the wild

• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent governance is now an identity problem, not only an AI problem. The article shows that agents inherit familiar non-human identity patterns while behaving in ways that are harder to predict and constrain. That means the control gap sits across IAM, PAM, consent and secrets governance rather than in any single tool. Practitioners should treat agent identity as a first-class governance domain.

Delegated trust is the new failure surface. When a user can connect one application to another on behalf of the business, the real risk is not just unauthorized access. The risk is that consent becomes a shadow approval layer outside administrator intent. This is especially acute where app-to-app links can reach crown-jewel systems, and it requires stronger control over who can create those connections.

Long-lived secrets create identity debt for agentic systems. Agent integrations that rely on copied tokens or persistent credentials extend the lifetime of compromise and make revocation harder. Ephemeral credential trust debt: once teams normalise static secrets for convenience, every new agent connection adds more durable exposure than the programme can realistically review. The practitioner conclusion is simple: static credentials become the weakest part of the agent stack.

Access review assumptions collapse when identities can act and adapt faster than governance cycles. Traditional certification assumes an access state persists long enough to be observed, evaluated and recertified. With AI agents, the access path can be assembled, used and extended before the review window opens. The implication is that governance has to move closer to issuance and connection-time control, not only periodic attestation.

The control model now has to cover human choice, NHI execution and autonomous behaviour in one chain. Users may initiate the connection, the agent may execute across applications, and the credential may persist beyond both. That combination is why identity teams cannot isolate AI governance from NHI and human access governance. The practitioner implication is to unify policy, visibility and offboarding across all three layers.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

AI agents are now forcing identity programmes to choose between speed and governability. When a system can plan, execute and iterate across multiple applications, static IAM assumptions about fixed privilege boundaries no longer hold cleanly. The programme response is to govern connection paths, not just accounts, because the access state may change before recertification ever sees it.

Ephemeral credential trust debt: agentic integrations often start with convenience credentials and then accumulate more permanent exceptions over time. That creates a debt load that grows each time a new token or app-to-app permission is accepted, especially when 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.

For practitioners

• Map every agent connection path Inventory which AI tools, service accounts, API tokens and OAuth scopes each agent uses, then tie those paths to the business resources they can reach.
• Centralise app-to-app consent Block uncontrolled user-consent flows for sensitive applications and route higher-risk app-to-app access through administrator-approved governance.
• Reduce dependence on long-lived secrets Replace copied credentials and persistent tokens with shorter-lived, centrally governed alternatives wherever an integration can support them.
• Review agent access as a lifecycle issue Treat AI agent onboarding, scope changes and offboarding as lifecycle events that require the same discipline used for other non-human identities.

Key takeaways

• AI agents create a governance problem because they combine non-human authentication patterns with non-deterministic runtime behaviour.
• The biggest risk is not only visibility loss but also delegated access that can reach sensitive resources through app-to-app connections.
• Teams that still depend on long-lived secrets and periodic reviews will struggle to control agentic access before it expands beyond policy.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Application-to-Application Access: Application-to-application access is machine-driven connectivity between software systems that lets one application authenticate to another and exchange data or actions. It typically depends on secrets, tokens, certificates, or delegated permissions, so governance must cover both the connection itself and the credentials behind it.
• Long-Lived Secret: A long-lived secret is a credential, token, API key, or certificate that remains valid for an extended period without frequent renewal. In NHI environments, it creates durable exposure because one leaked secret can keep granting access long after the original use case has changed.
• Delegated trust: Delegated trust is the decision to let another system or organization issue, validate, or transmit access on your behalf. It is common in cloud and SaaS environments, but it becomes risky when scope, duration, and revocation are not tightly controlled. In NHI governance, delegated trust must be explicit and continuously reviewable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.