AI agent security needs an application perimeter, not just controls

At a glance

What this is: Andromeda Security argues that AI agent governance should be built around an application perimeter, where the app and its callable tools become the primary control surface.

Why it matters: This matters because IAM, NHI, and agent governance teams need to evaluate access in real time across the human, agent, and intended action, not just manage standing roles or isolated permissions.

Context

AI agent governance is no longer just about whether a model can call tools. The issue is that an agent can chain those tools across applications, discover new endpoints while it runs, and do so at a pace that outstrips reactive control models.

For identity teams, that changes the unit of governance from the agent alone to the application surface it is allowed to touch. The central question becomes how to control tool use, intent, and entitlements at the point of execution rather than after the fact.

Key questions

Q: What breaks when AI agents are not governed at runtime?

A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context. That is where tool chaining, MCP connections, and rapid decision-making become dangerous. Static approval cannot stop a live change in intent, so teams lose control at the point of action.

Q: Why do AI agents increase identity risk even when the login succeeds?

A: A successful login only proves that the agent reached the system. It does not prove that the specific action was authorised for that task, in that environment, at that moment. AI agents can chain tools and cross systems, so the authorisation problem moves to runtime intent and not just initial authentication.

Q: What are the signs that agentic access controls are failing?

A: The main signs are invisible tool use, delayed discovery of actions, and audit logs that explain an outcome only after it has already occurred. If a security team cannot see which agent attempted which action on which target at the moment of execution, the control is monitoring, not governing.

Q: Who should own policy governance for human, NHI, and agent access decisions?

A: Identity governance teams should own the policy model, with security architecture and application teams supporting enforcement and telemetry. The key is one consistent governance framework that covers human users, service identities, and AI agents without splitting rules across separate control planes.

Technical breakdown

Access evaluation triad for agentic governance

The article’s central control primitive is the triad of human sponsor, acting agent, and intended action. That triad matters because evaluating only the person and the agent, or the agent and the action, leaves a blind spot at the tool-call layer. In practice, this is a real-time authorisation problem, not a retrospective audit problem. The governance decision has to compile identity context, risk context, and the action being requested into a single allow or deny outcome before the tool call executes.

Practical implication: design policy decisions around all three elements together, not around static role membership or agent registration alone.

Why the application perimeter becomes the attack surface

In the pre-agent model, applications were usually consumed in predictable patterns. In the agentic model, each application exposes callable tools that can be discovered, chained, and invoked autonomously, which makes the application itself the surface being governed. That shifts the security boundary from the user interface to the tool layer. It also means that entitlement design must account for how one permitted capability can lead to several others once the agent starts composing actions across systems.

Practical implication: inventory governed application tool surfaces and evaluate which combinations of tools create unintended execution paths.

Composable policy for tool calls and approval gates

The article points to a policy engine that can express reusable rules for whether a tool call is perpetual, conditional, or subject to approval. That is different from legacy role assignment because the same action may be acceptable in one context and not in another. Composable policy matters because agent populations will be large, and administrators need to reason in patterns, not one-off wiring. The control challenge is to make policy flexible enough to capture intent without becoming so permissive that it simply replays old access models.

Practical implication: move toward policy composition that can enforce context-sensitive approval logic at the tool-call layer.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic governance fails when the application is treated as downstream of identity. The article correctly reframes the problem: in agentic systems, the application surface is where identity becomes operational. That means governance cannot stop at granting the agent access, because the real risk emerges when tool chaining turns one allowed action into many reachable actions. Practitioners should treat governed applications, not the agent alone, as the boundary that matters.

The access evaluation triad is the right abstraction because intent is part of authorisation. Human, agent, and action are not separable checkpoints, they are one decision. If a programme evaluates only who is acting and what system is involved, it misses the purpose of the request and loses the ability to distinguish routine automation from risky delegation. The implication is that authorisation design for agentic workloads has to become context-aware at runtime.

Human access to agents creates an indirect lateral path that legacy entitlement models do not represent. The article notes that a human’s access to an agent can open a route to every application that agent can reach. That is a governance problem because the blast radius is no longer obvious from direct entitlements alone. The named concept here is application perimeter drift: the effective security boundary expands as tool reach is composed across systems, so identity governance must track reachable applications, not just assigned permissions.

Human IAM, NHI governance, and agent security are converging into one control plane. The article is right to collapse these into a single programme viewed at different layers of the call chain. The practical consequence is that separate policy stacks for people, workloads, and agents will create gaps at the seams. Practitioners should assume that agentic access decisions will increasingly depend on cross-domain identity graph context.

Agent scale changes the governance model from exception handling to population control. The article’s emphasis on composable policy and group-level reasoning reflects the real scaling pressure. When agents outnumber humans, manual approval logic becomes unworkable, and administrators need intent-based policy at population level. The implication is not just more automation, but governance designed for reusable decisions across large agent fleets.

From our research library:

• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: AI Agent Authorisation Guide

What this signals

Application perimeter drift: once an agent can chain tools across multiple applications, the effective security boundary expands beyond the original entitlement. That means governance teams need to reason about reachable applications and not just assigned access, especially where tool discovery is possible at runtime.

Agentic control has to move to issuance and execution time, because reactive review cycles are too slow for tool calls that complete in seconds. The practical change for programmes is to treat human context, agent context, and action context as one decision object rather than separate checks.

Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey. That gap suggests most teams are still designing for yesterday’s access model while agentic execution is already changing the control surface.

For practitioners

• Define the application perimeter Map each critical application to the specific tool surfaces an agent can invoke, then classify which tool combinations create unacceptable data or action exposure.
• Evaluate the full access triad Require every agentic access decision to include the human sponsor, the acting agent, and the intended action before the tool call is allowed.
• Replace static role logic with composable policy Use reusable policy rules that can express conditional approval, perpetual allowance, or denial for a tool call based on context and risk.
• Track indirect lateral reach from agent access Review what downstream applications become reachable when a person is allowed to use a given agent, then treat that reach as part of the person’s risk profile.

Key takeaways

• AI agents turn applications into governed tool surfaces, so the control boundary shifts from static identity records to live execution decisions.
• The article’s core governance model is the access evaluation triad, where human sponsor, acting agent, and intended action must be assessed together.
• Programmes that keep relying on legacy role assignments will miss indirect reach and tool chaining, which is where agentic blast radius grows.

Key terms

• Access Evaluation Triad: The access evaluation triad is the three-part decision set of human sponsor, acting agent, and requested action. It exists because no single element fully describes risk in an agentic workflow. The triad makes authorisation context-aware and is especially useful when the same agent can act for different users.
• Application Perimeter: The application perimeter is the boundary formed by the tools, APIs, and actions an identity can reach inside a business system. For AI agents, it becomes the real enforcement point because the agent may discover and chain calls across multiple applications, making the application surface more important than the login event.
• Composable Policy: Composable policy is a reusable policy design that combines identity, context, and action rules into machine-evaluable decisions. In agentic environments, it matters because one-off approvals do not scale. The policy must be able to express intent once and enforce it consistently across many tool calls and applications.
• Reachable Applications: Reachable applications are the downstream systems an identity can access indirectly through an allowed agent or delegated workflow. The concept matters because indirect reach often creates more blast radius than the direct entitlement record suggests.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.