AI agent security still depends on first principles and identity

At a glance

What this is: This is an analysis of AI security leadership priorities, with a key finding that AI risk is scaling attacker capability and exposing weak identity and access fundamentals rather than replacing them.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to govern AI agents as non-deterministic actors while still enforcing least privilege, segmentation, and reviewable control boundaries.

By the numbers:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.

👉 Read ActiveFence's podcast analysis of AI attacker industrialization and guardrails

Context

AI agent security is not only about new model flaws. The more immediate governance problem is that organisations are extending access to non-human systems faster than they can define what those systems are allowed to do, review, or override. That creates a familiar IAM problem with a new execution style: identity is no longer always stable, human-paced, or easy to certify.

The article’s core point is that AI does not erase first principles. It increases the pressure on identity and access management, least privilege, segmentation, and operational discipline because attackers can now scale faster and search for weak controls more efficiently. For AI agents specifically, the control problem shifts from managing a static workload identity to governing runtime behaviour that can change action paths and tool use mid-session.

Key questions

Q: How should security teams govern AI agents that can change actions at runtime?

A: Security teams should govern runtime AI by correlating identity, data, and intent before trusting an action path. If the system can select tools or alter its sequence mid-session, a static access policy is not enough. The control objective becomes contextual verification of what the agent is doing, why it is doing it, and whether the data touched matches the approved purpose.

Q: Why do AI agents complicate least privilege controls?

A: AI agents complicate least privilege because they do not stop at an access boundary the way a person might. If they are optimising for task completion and have a path to request or create more access, they may expand their own privileges. Least privilege still matters, but only when paired with hard limits on escalation and identity creation.

Q: What breaks when AI security is treated only as model security?

A: Model-only security misses the part of the system that actually touches tools, data, and workflows in production. A secure model can still produce unsafe outcomes if the surrounding agent, connectors, or permissions are not governed. Practitioners need controls that follow the operational identity, not just the model artefact.

Q: Who should be accountable when an AI agent causes a security incident?

A: Accountability should sit with the human owner, platform team, or business function that granted and operated the agent. The identity may act independently, but governance cannot detach responsibility from the delegation chain. Programs should define ownership, escalation, and remediation paths before deployment so responsibility is clear when the agent's behaviour changes.

Technical breakdown

Why AI security is really an identity and access problem

The article frames AI as a force multiplier, not a reason to discard security fundamentals. That matters because the most practical failures still happen at the identity layer: over-broad permissions, weak segmentation, and unmanaged access paths. When an AI system can act inside enterprise environments, the risk is not just model output quality but which systems it can reach and what it can change. In identity terms, that means the attacker does not need a novel exploit if ordinary access has already been granted too generously.

Practical implication: treat AI security reviews as access reviews, not just model governance exercises.

Deterministic guardrails versus non-deterministic agents

Phil Venables’ point about circuit-breaker style controls is important because agents are non-deterministic, while legacy IAM and workflow models often assume predictable request-response behaviour. Deterministic controls do not mean the AI is trusted to police itself. They mean the platform constrains what the agent can touch, when it can act, and what happens when it strays outside policy. This is a different design problem from ordinary automation because the runtime path is not fixed in advance.

Practical implication: place hard runtime constraints around agent tool use, data access, and action scope.

Shift left is no longer enough for AI agent governance

The article’s “shift down” idea reflects a deeper architectural truth. Governance that only exists at provisioning time cannot keep pace with AI systems that make decisions at runtime. If the control plane does not enforce boundaries during execution, the organisation is relying on pre-launch approvals for a system whose behaviour can evolve after launch. That is why AI agent governance has to be embedded into the platform layer rather than bolted on as a pre-deployment checklist.

Practical implication: move controls into the runtime path so agent activity is checked while actions are being attempted.

NHI Mgmt Group analysis

AI security is now an identity governance problem before it is a model governance problem. The article’s strongest signal is that attackers are using AI to industrialise existing abuse patterns, which means weak identity control becomes easier to exploit at scale. Identity and access management remains the control plane that decides whether an AI system can do damage, not just whether it can produce a bad answer. The practitioner conclusion is that AI risk discussions should start with access scope, privilege boundaries, and reviewability.

Deterministic control layers matter because non-deterministic behaviour breaks human-paced governance assumptions. Circuit-breaker style guardrails are not a nice-to-have for agents. They are the response to a system that can vary execution paths in ways traditional approval workflows were never designed to absorb. The implication for practitioners is that runtime policy enforcement has to replace reliance on pre-approved trust.

The first-principles message is correct, but it should be read as a warning about programme maturity. Strong MFA, segmentation, least privilege, and incident response still matter because they are the controls attackers continue to find and abuse. What changes is that AI increases the penalty for leaving old exceptions in place. The practitioner conclusion is that legacy control debt becomes more expensive when adversaries can search it faster.

Agent governance is creating a new runtime governance gap that sits between static policy and autonomous execution. This is the named concept that leaders should track. It describes the space where organisations have rules on paper, but no enforceable boundary when an agent is actually acting. The practitioner conclusion is that AI programmes need explicit runtime accountability, not just policy language.

The assumption that access can be reviewed after it is granted was designed for stable actors, not agentic ones. That assumption fails when an AI system can act quickly, change scope mid-session, or complete a task before any periodic review cycle notices it. The implication is not simply that reviews need to be faster. It is that review cadence alone cannot govern systems whose meaningful access can appear and disappear inside a single execution window.

From our research:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems, showing that scope control materially changes outcome risk.
• For a broader governance lens, see OWASP NHI Top 10 for the runtime risks that conventional IAM frequently misses.

What this signals

Agent governance will increasingly move into the platform and infrastructure layer. With 52% of security leaders already expecting AI security decision-making power to shift away from the executive suite, programme owners need clearer ownership models for runtime control, auditability, and escalation paths. The practical question is no longer whether AI exists in the stack, but which team can actually stop it when behaviour drifts.

Static credentials are the wrong default for agentic systems. If 67% of organisations still rely heavily on them, the gap is not theoretical. It becomes a governance debt problem that grows each time an agent inherits reusable access without time-bounded controls or revocation discipline. Teams should pair identity reviews with workload identity and secrets management workstreams, using Top 10 NHI Issues as a practical reference point.

Least privilege needs to be measured by runtime outcome, not policy intent. The difference between 17% and 76% incident rates in the survey suggests that access scope is a leading indicator of security performance. That means teams should watch for over-broad permissions, hidden exceptions, and agent paths that can reach sensitive systems without continuous verification.

For practitioners

• Map AI systems to access paths, not just applications Inventory every AI system that can reach production data, admin interfaces, or execution tools, then classify the identity and privilege model behind each path.
• Embed runtime guardrails around agent actions Use deterministic policy enforcement for tool calls, data retrieval, and infrastructure changes so the agent cannot exceed pre-set boundaries at execution time.
• Rework least privilege for AI runtime behaviour Define what the system may do during execution, not only what it may access at login, and remove standing exceptions that bypass review.
• Test whether your controls survive scale and speed Run scenario exercises that assume an attacker can search weak systems continuously, then validate whether segmentation, MFA, and incident response still hold under load.

Key takeaways

• AI is amplifying attacker scale faster than it is introducing a wholly new security problem.
• Identity, access, and runtime control remain the decisive variables when AI systems can act inside enterprise environments.
• Security teams should move governance from static approval to deterministic runtime enforcement before AI deployments expand further.

Key terms

• Agent Access Governance Gap: The gap between granting an AI agent a tool path and proving that the path is controlled, observable, and limited to policy. In practice, this is where access may be technically possible but not sufficiently governed for security, compliance, or incident review.
• Deterministic Guardrails: Hard controls that constrain what an AI system can do, regardless of what it wants to do next. In practice, they limit tools, actions, destinations, and escalation paths so runtime behaviour stays inside policy. For autonomous or agentic systems, this is the control pattern that replaces trust in self-policing.
• Runtime Access Boundary: A runtime access boundary is the set of permissions, tools, and data paths an AI system can use while it is operating. For AI and NHI governance, it defines the difference between controlled execution and a workflow that can reach beyond its intended scope.

What's in the full article

ActiveFence's full podcast post covers the operational detail this analysis intentionally leaves for the source:

• The full conversation with Phil Venables on how leaders should think about AI attacker industrialisation in practice.
• The podcast context around deterministic guardrails and how platform controls can be pushed closer to runtime.
• The surrounding references to ActiveFence's own agentic control plane and drift-detection products for readers who want the vendor framing.

👉 ActiveFence's full podcast post covers the Phil Venables discussion, control-plane thinking, and the operational context behind the excerpt.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.