AI agent security platforms expose the limits of legacy IAM controls

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WitnessAI's blog post: AI agent security platforms are exposing a gap in legacy IAM, because machine-speed agents operating across multiple systems need runtime governance, not just access provisioning.

Why it matters: For IAM, PAM, and NHI teams, the issue is that agentic workflows turn static permission models into a runtime governance problem that crosses human, machine, and autonomous boundaries.

By the numbers:

• Two-thirds (66%) of organizations report productivity and efficiency gains from AI adoption.

Context

Enterprise AI is creating a governance problem that sits between IAM, NHI security, and runtime policy enforcement. The core issue is not whether organisations have access controls in place, but whether those controls still make sense when AI agents can act across multiple systems with elevated permissions at machine speed.

WitnessAI frames the market as a comparison of LLM security platforms, but the practical question is broader: which deployment model can actually see, classify, and constrain AI activity across the full footprint of employees, models, apps, and agents. That is now an identity and control-plane question, not just a model-security question.

The central tension is that legacy defenses were built for bounded access paths and slower approval cycles. Once agentic workflows start touching desktop apps, MCP servers, and tool calls, the governance challenge becomes continuous observation and policy enforcement rather than periodic review.

Key questions

Q: Why do AI agents break traditional IAM assumptions?

A: AI agents break IAM assumptions because they do not behave like predictable users. They can authenticate to multiple systems, select tools dynamically, and execute tasks at machine speed without a human approval gate between actions. That removes the stable login session that traditional IAM uses as its trust anchor.

Q: Why do elevated AI agent permissions create more risk than standard user access?

A: Elevated permissions matter because agents can use them at machine speed across multiple systems without the pauses that human workflows create. That raises the chance of data exposure, tool misuse, and unintended cross-system actions. The risk is not just scope, but the speed and autonomy of the workflow.

Q: What signals show that an AI security platform is actually working?

A: Look for measurable drops in false positives, faster triage, fewer manual interventions, and a clear reduction in analyst workload. A credible platform should also show that it can act on trustworthy classification and policy context, not merely summarise noisy data more quickly.

Q: How do organisations decide between browser-first and broader AI governance controls?

A: Choose browser-first controls only when AI use is genuinely web-bound and low complexity. If developers, desktop users, or agents are already working outside the browser, broader controls are needed so discovery, policy, and runtime protection follow the interaction surface instead of the other way around.

Technical breakdown

Why legacy IAM breaks down for agentic workflows

Legacy IAM assumes the actor requesting access is relatively stable, the action path is known in advance, and the control point is mostly at authentication or provisioning time. AI agents do not behave that way. They can traverse multiple systems in a single task, combine tools dynamically, and carry elevated permissions into workflows that were never designed for machine-speed execution. That shifts risk away from login events and toward runtime decisions, which is where traditional IAM coverage is weakest. When an agent can act inside applications, browser sessions, and native desktop workflows, identity becomes an execution problem rather than a directory problem.

Practical implication: Treat agentic access as a runtime governance issue and evaluate controls that inspect action context, not just user or service identity.

What visibility into prompts, responses, and tool calls actually changes

Prompt-only monitoring gives an incomplete view because the security-relevant event may be the response, the tool call, or the data the agent exfiltrates after the model interaction. Bidirectional runtime defense matters because the control needs to see both sides of the exchange and decide whether to route, redact, or block based on intent and context. The same logic applies to agentic workflows and MCP server discovery: if the platform cannot see how the agent is reaching tools, it cannot govern what the agent is doing with them. Visibility without enforcement is telemetry, not control.

Practical implication: Prioritise platforms that can inspect both sides of the AI interaction and enforce policy before sensitive data leaves the environment.

Why policy granularity matters more than binary allow or block

Binary allow-or-block controls are too coarse for enterprise AI because the same interaction may be acceptable in one role, one application, or one context and risky in another. The article highlights route, redact, and context-aware policies as a more usable model because they preserve business flow while still reducing exposure. This is especially important where agents operate alongside human users and digital workforce processes, because one rigid policy can either over-block legitimate work or under-protect sensitive workflows. Granularity is not a convenience feature. It is the difference between governance that scales and governance that gets bypassed.

Practical implication: Use context-aware policy tiers so sensitive AI interactions can be constrained without forcing broad operational shutdowns.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent governance exposes an assumption collapse in legacy IAM. Legacy access models were designed for identities whose intent could be inferred at provisioning time and whose actions unfolded inside predictable request-response loops. AI agents break that assumption because they can select actions, chain tools, and execute inside the task itself. The implication is that governance has to move from static entitlement review to runtime authority control.

Network-level visibility is becoming a control prerequisite, not a deployment preference. A platform that cannot see native desktop apps, agentic workflows, and tool calls will miss the places where AI risk now accumulates. Browser-only or log-only approaches may still be useful, but they no longer define the full boundary of AI security. Practitioners should treat coverage gaps as governance gaps, not just architectural trade-offs.

Intent-based policy is the right unit of control for enterprise AI. The article’s strongest signal is that role alone is too blunt, while keyword matching is too shallow, for AI governance. Policies need to understand whether an interaction is trying to expose data, route a model request, or trigger a tool call. That shifts the discipline toward context-rich decisioning, which is where modern NHI and agentic AI controls converge.

Agentic security is now a cross-domain identity problem, not a standalone AI problem. The same environment can contain humans, service accounts, copilots, embedded models, and autonomous agents, all touching the same data and systems. That means IAM, PAM, NHI governance, and AI security must be aligned around shared visibility and policy logic. Organisations that keep those programmes separate will keep finding blind spots at the seams.

From our research library:

• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Agentic AI security is becoming a governance boundary issue. Once AI can reach native apps, MCP servers, and cross-system tools, the useful control point shifts from initial access to runtime decisions. Teams that still measure coverage by login or browser visibility will miss where the actual risk now accumulates.

Intent-based control will matter more than identity labels. Role, account type, and model name are no longer enough to decide whether an AI interaction is safe. Security programmes need policy logic that can distinguish between routine assistance and actions that can expose data or trigger downstream tool calls.

Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey. That gap is why AI governance now has to be designed as an execution control problem, not a visibility exercise.

For practitioners

• Map the full AI footprint Inventory where AI is used across browsers, native desktop apps, embedded copilots, MCP-enabled workflows, and custom agent flows so coverage gaps are visible before policy design starts.
• Classify agent interactions by intent and context Separate benign productivity use from higher-risk actions such as data exposure, tool invocation, and cross-system access so policies can be targeted instead of universal.
• Test runtime enforcement, not just telemetry Verify that the platform can route, redact, or block at the moment of interaction rather than only logging events after the fact.
• Confirm coverage for agentic workflows and tool calls Validate whether the control plane can discover agents, observe tool calls, and maintain identity attribution back to the human or system that initiated the workflow.
• Separate governance requirements by deployment model Compare browser-only, endpoint-based, network-level, and SASE-integrated approaches against the specific environments where your AI activity actually occurs.

Key takeaways

• AI agents with elevated permissions are forcing security teams to rethink IAM as a runtime governance problem rather than a provisioning problem.
• The article’s comparison shows that visibility, policy granularity, and enforcement model matter more than broad feature lists when evaluating AI security platforms.
• Organisations need controls that cover prompts, responses, tool calls, and native app activity if they want coverage across the full AI footprint.

Key terms

• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Intent-Based Policy: Intent-based policy evaluates why an AI interaction is happening, not just what text it contains. In regulated environments this matters because the same data can be benign or risky depending on purpose, context, role, and downstream action, making intent a core control variable.
• Integration Footprint: The normal infrastructure, API behaviour, and data access pattern associated with a trusted SaaS connector. Security teams use it to tell legitimate integration traffic from abuse, especially when a valid token is used from an environment that does not match the expected vendor footprint.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.