AI agent security needs both content checks and access controls

At a glance

What this is: This is an analysis of AI agent security that separates content safety enforcement from purpose-based access control and shows why delegation chains create an identity propagation gap.

Why it matters: IAM, PAM, and NHI teams need this distinction because agentic systems can pass content checks while still carrying standing or over-broad access through multi-hop delegation.

👉 Read Trust3's analysis of AI agent guardrails, purpose-based access, and A2A security

Context

AI agent security is not one control problem. Content safety checks can block unsafe prompts or outputs, but they do not answer whether an agent should be authorised to reach a tool or dataset in the first place. That distinction matters because delegated agent chains can preserve or expand scope even when each individual request appears safe.

The core governance issue is purpose and identity continuity across hops. In an autonomous or agentic workflow, the security question shifts from whether the content is acceptable to whether the actor still has the right purpose, scope, and access at the moment the next tool call is made. That is where traditional request-level checks start to miss the real risk.

This is a typical pattern in early AI control deployments: teams add inline guardrails first because they are visible and easy to measure, then discover that authorisation and delegation are the harder part of the problem.

Key questions

Q: What breaks when security teams rely on content guardrails to control AI agents?

A: Content guardrails only inspect what an agent says, not what it does. They fail when the real risk is action execution, because an agent can still use credentials, reach external systems, or probe infrastructure while producing harmless text. Security teams need runtime authorization and containment, not just prompt and output filtering.

Q: Why do delegated AI agent chains increase access risk?

A: Because each hop can lose the original task boundary. If identity and scope are not propagated across delegation, downstream agents may inherit access that no longer matches the initiating purpose. The result is scope drift, where the chain still looks legitimate in traces but is no longer governed by the same access decision.

Q: What are the signs that AI agent security controls are too weak?

A: Common warning signs include agents accessing systems or data outside their intended scope, sharing sensitive information inappropriately, and using credentials or tools without clear justification. Another indicator is inconsistent visibility into what the agent touched, especially when security, compliance, and legal teams do not share the same view of agent activity and data access.

Q: Should organisations use content filters or purpose-based access control for AI agents?

A: They need both, but for different reasons. Content filters stop unsafe text and data leakage, while purpose-based access control decides whether the agent is entitled to act at all. If you must choose the first governance priority, start with access control for high-risk tools and data because it blocks misuse before execution.

Technical breakdown

Content safety checks versus authorisation decisions

Content guardrails inspect the prompt, output, or intermediate text for unsafe material such as jailbreak attempts, toxic content, PII, PHI, or secrets. Purpose-based access control answers a different question: whether the actor, for this declared task, should be allowed to call a tool or read a data source at all. The two controls operate at the same moment in the workflow but govern different security properties. A request can be perfectly clean from a content perspective and still be unauthorized from an access perspective. That is why an AI control plane that only inspects text cannot replace identity-aware authorisation.

Practical implication: Map content filtering and access authorisation to separate control owners and do not treat one as coverage for the other.

Why delegation chains erode identity and scope

Multi-agent, or A2A, chains create a propagation problem. The initial agent may have a valid purpose and scope, but once work is handed to another agent, the system needs to preserve the original identity context and task boundary across each hop. Without that propagation, the last hop sees a request but not the provenance that justified it. In practice, delegation can become a scope expansion mechanism, especially when downstream agents inherit broad tool access or reuse standing credentials. The technical failure is not just visibility loss; it is loss of authorisation continuity.

Practical implication: Require every delegated hop to carry task scope and provenance, not just trace metadata.

Inline enforcement only works if the access decision is still current

Inline controls are strongest when they can make a real-time decision before an action executes. But in agentic systems, the decision can become stale between the first and third hop if access is pre-granted or not re-evaluated against the current purpose. That is especially true when agent state changes, tools are selected dynamically, or one agent triggers another. A request may look identical at the boundary while its intended purpose has drifted. The control challenge is therefore not speed alone, but whether the policy engine evaluates the current actor, current purpose, and current target together.

Practical implication: Use request-time checks that re-evaluate purpose, scope, and target data or tools at every hop.

Threat narrative

Attacker objective: The objective is to turn a legitimate agent workflow into a broader access path that reaches data, tools, or actions outside the original purpose.

1. Entry occurs when a legitimate agent or delegated sub-agent receives access to data or tools for a narrowly defined task.
2. Escalation occurs when that access is reused, inherited, or expanded across additional agent hops without a fresh purpose-based authorisation decision.
3. Impact occurs when a downstream agent reaches data or executes actions beyond the original task boundary, creating unauthorized access or unintended disclosure.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Content safety is not an authorisation model: Inline guardrails that inspect prompts and outputs solve a narrow class of AI risk, but they do not decide whether an agent should reach a tool or dataset. That distinction matters because identity governance fails when teams assume a clean request is the same as an authorised request. The practitioner implication is to treat content safety and access control as different control families, not interchangeable layers.

Delegated agent chains create scope continuity risk: The hard problem in A2A security is not visibility into handoffs, it is preserving the original purpose and scope across those handoffs. Once that chain breaks, downstream agents can inherit access that no longer matches the initiating task. That is a governance problem for IAM, PAM, and NHI controls alike, and teams should evaluate how far identity context survives in the chain.

Purpose-based access control is becoming the missing identity layer for agentic systems: If the system can evaluate declared purpose before action, it can narrow access without relying on static standing privilege. This is the right direction for agentic AI because the control decision must follow the task, not just the actor. Practitioners should make purpose a first-class part of the authorisation model, not an annotation.

Identity propagation is the named control gap: Delegation-chain identity propagation is the point where agentic workflows either preserve who is acting and why, or lose that context after the first handoff. Once the identity and scope dissolve, later requests are only technically linked to the origin through traces, not governance. That means auditability alone is not control, and teams need to recognise the difference.

Agentic AI governance will converge with NHI discipline: AI agents behave like non-human identities at runtime, which means the same lifecycle questions appear immediately: ownership, scope, revocation, and offboarding. The article reinforces that the field is moving toward identity-aware control planes rather than model-only safety layers. Practitioners should prepare for agent governance to sit inside IAM and NHI programmes, not beside them.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, while inadequate monitoring and logging and over-privileged accounts each account for 37%.
• The next step is to examine Ultimate Guide to NHIs , Key Challenges and Risks for the lifecycle controls that close these access gaps.

What this signals

AI agent programmes are moving into the same governance territory as service accounts and workload identities. The practical issue is not whether an agent can be observed, but whether its access can be explained, limited, and revoked at the moment of execution. With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, the access problem is already familiar in NHI programmes and is now being reintroduced through agentic systems.

Delegation-chain identity propagation: this is the control concept practitioners should start using for A2A systems. It describes whether the original actor, purpose, and scope survive every handoff, or vanish into traces that can be audited later but not governed in real time. That distinction will shape how IAM and NHI teams design policy engines, approval paths, and revocation handling for agent workflows.

For teams building a forward programme, the signal is that agent security will not sit cleanly inside model monitoring or AppSec alone. It will sit at the intersection of authorisation, lifecycle governance, and machine identity operations, which means the operating model must include clear ownership for agent scope, tool reach, and offboarding. That is the programme shift now taking shape.

For practitioners

• Separate content and access control ownership Assign one control path to inspect prompts and outputs and a different control path to decide whether the agent may reach the tool or dataset. Do not count content redaction as authorisation.
• Propagate identity through every agent hop Require each delegated request to carry task scope, actor context, and provenance through the full chain, including MCP calls and sub-agent handoffs. A trace without preserved scope is only visibility, not governance.
• Re-evaluate standing access for agentic workflows Review whether agents hold persistent permissions that outlive the task. Replace broad standing access with request-time evaluation that can narrow or deny access when the current purpose no longer matches.
• Audit revocation at the next request boundary Test whether a compromised or drifting agent can be stopped before its next action executes, not only after the fact in logs or traces. The control needs to interrupt execution, not just observe it.

Key takeaways

• AI agent security splits into two controls: content safety and authorisation. Treating them as the same thing leaves tool and data access exposed even when prompts and outputs are clean.
• Delegation chains are where identity and scope break down. Without propagation of purpose and provenance, downstream agents can act outside the task that originally justified access.
• Practitioners need request-time access decisions for agent workflows. The decisive control is whether the agent should reach the resource at the moment it acts, not whether the text around the action looks safe.

Key terms

• Intent-Based Access Control: An access control model that evaluates not just what an agent is requesting, but the inferred intent and context behind the request — granting or denying access based on whether the action aligns with the agent's declared purpose.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Runtime Guardrail: A control applied while an AI agent is operating, not just during configuration or review. Guardrails can block dangerous tool calls, require approval for sensitive actions, or stop data leakage before it reaches systems or users.
• Identity propagation: The preservation of origin and acting principal information as a request moves through multiple services. In MCP chains, this is what allows downstream systems to make a trustworthy authorization decision instead of relying on a stripped-down token with no task context.

What's in the full article

Trust3's full article covers the operational detail this post intentionally leaves for the source:

• The vendor's side-by-side explanation of inline guardrails versus purpose-based access decisions for agent workflows.
• The specific request-path and tracing model Trust3 says it uses to carry identity through multi-hop A2A chains.
• The operational treatment of JIT grants, scoped execution, and MCP-related handoffs in agent security.
• The vendor's own examples of how its control plane handles delegated requests and correlated audit records.

👉 Trust3's full article explains the guardrail model, delegation-chain handling, and purpose-based access details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI programme, it is worth exploring.