AI agent security vs protection: why runtime enforcement matters

At a glance

What this is: This article argues that AI agent security and AI agent protection are different layers, and that runtime enforcement is required to stop authorized agent actions that turn harmful after execution begins.

Why it matters: It matters because IAM, IGA, and security teams cannot rely on governance records alone when AI agents can act faster than human review and use valid credentials to carry out harmful workflows.

Context

AI agent security is the governance and observability layer for embedded AI agents. It defines what the agent may access, records what it did, and helps teams discover shadow agents, shadow APIs, and tool use that falls outside normal inventories.

The governance problem is that visibility and static policy checks cannot stop an agent once a malicious or manipulated session is already in motion. For identity teams, that creates a control boundary issue across NHI, tool access, and runtime enforcement rather than a simple logging problem.

Impart frames the distinction as one of posture versus enforcement. The article’s core claim is that organizations need both, because agent activity can look authorized at the credential layer while still becoming unsafe at the session level.

Key questions

Q: What breaks when AI agent security is handled like ordinary application security?

A: Application security assumes a relatively stable workload boundary and a predictable request path. AI agents can select tools, access data, and continue executing in ways that change the path mid-workflow. When teams treat them like static apps, they miss the identity and authorisation layer where real risk appears.

Q: Why do authorised agent actions still create security risk?

A: Because authorization alone does not prove the action was appropriate. An agent can use valid credentials to reach systems it is allowed to access while still performing a semantically unsafe task, such as exfiltrating data or deleting resources. The risk comes from combining legitimate access with manipulated intent, which many traditional tools are not built to judge.

Q: What are the signs that AI agent governance is too weak for production use?

A: Weak governance usually shows up as poor visibility into what agents can access, incomplete audit trails, and inconsistent oversight across security, legal, compliance, and operations teams. Another warning sign is when organizations cannot explain which datasets an agent used or why it took a specific action. Those gaps make investigation, containment, and compliance far harder.

Q: How should security teams respond when an AI agent attempts a risky action?

A: They should interrupt the action before it becomes permanent, explain the denial in terms the agent can use, and log the event for review. If the workflow can continue safely, the agent should be redirected into a permitted path rather than simply shut down.

Technical breakdown

Identity and authorization controls for AI agents

AI agents commonly authenticate through an identity provider and operate with explicit scopes, which places them squarely in the non-human identity model. That layer governs OAuth tokens, API keys, service credentials, approved tools, and permission boundaries. It is the place where practitioners decide which systems an agent may call and under what conditions, but it only defines the envelope of access, not the safety of each action taken inside that envelope.

Practical implication: treat agent identities, tokens, and scopes as governed non-human identities, not as generic application settings.

Why static policy and audit logs stop short

Static policy enforcement can block known-bad tools or actions before runtime, while audit logging reconstructs what happened after the fact. Neither control can reliably stop a harmful multi-step workflow once it begins, because each individual call may still look authorized. That limitation becomes acute when the same credential can be used for legitimate updates, exfiltration chains, or session redirection, all of which appear structurally similar at the log layer.

Practical implication: use policy and logs for governance and forensics, but do not treat either as a substitute for inline enforcement.

Runtime enforcement and session-level threat correlation

Runtime protection evaluates agent behaviour inline, with session context that includes the original task, tool sequence, and response content. That matters because agentic attacks often unfold across several valid actions rather than one obvious failure. The control point shifts from whether a call is allowed in isolation to whether the full sequence still matches the intended purpose of the session. In identity terms, the decisive control is no longer only authorisation at issuance, but enforcement at execution.

Practical implication: place behavioural controls at execution time when a session can drift from approved intent after access has already been granted.

Threat narrative

Attacker objective: The attacker aims to use legitimate agent access as a delivery mechanism for harmful actions that appear authorized until the session is already compromised.

1. Entry occurs through legitimate agent access, usually via OAuth tokens, API keys, or service credentials that were already authorized for the session.
2. Escalation happens when a prompt injection, poisoned tool output, or impersonation pattern redirects the agent mid-session without tripping a single authorization failure.
3. Impact follows when the agent performs harmful but credential-valid actions such as unauthorized writes, token abuse, or data exfiltration that only becomes visible after the fact.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent security is governance, not protection: The article correctly separates the layer that defines permission from the layer that can stop abuse at runtime. That distinction matters because identity governance records are not enforcement engines, and auditability does not equal containment. Practitioner conclusion: teams need to stop treating visibility as a control endpoint.

Runtime enforcement exposes the real agent problem: The security failure is not unauthorized access alone, but authorized access being used for a different intent after the session begins. That is why static allowlists and post-event logging cannot close the gap once the agent has context, tools, and valid credentials. Practitioner conclusion: the decisive control point is execution, not just approval.

Access review processes assume stable privilege windows: That assumption was designed for access that persists long enough to be observed, certified, and revoked on a cadence. It fails when an AI agent can acquire, use, and discard privilege within a single session, leaving no meaningful review artefact behind. The implication is that governance has to move from periodic review to session-aware control design.

Shadow agent detection is now a lifecycle issue: Discovery is not only a visibility function, it is an inventory and ownership problem for non-human identities that appear outside formal registration. When tools are installed locally or traffic bypasses the gateway, the governance record becomes incomplete by design. Practitioner conclusion: lifecycle controls must cover discovery, ownership, and offboarding together.

AI agent protection will become the architectural proof point: The market is converging on the recognition that governance and enforcement are complementary, not interchangeable. That will push teams to re-evaluate where policy lives, where runtime context is preserved, and which layer owns incident containment. Practitioner conclusion: architecture decisions should now be judged by whether they can stop agent behaviour, not just describe it.

From our research library:

• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Runtime enforcement has become the missing layer in agent governance: Access reviews assume a privilege lasts long enough to be certified. When agents can acquire and release access inside a single task, the control point moves from periodic review to inline containment. Security teams should evaluate whether their current design can interrupt agent behaviour, not just document it.

Shadow AI now includes shadow identity paths: Discovery gaps are not just inventory problems, they are governance failures when agents bypass the approved gateway or operate through local tooling. That is where non-human identity oversight and observability have to be joined to lifecycle ownership.

The case for tighter AI access scoping is already measurable: systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems, according to the 2026 Infrastructure Identity Survey. Teams that leave agent scope broad are accepting a materially larger attack surface.

For practitioners

• Map agent identities to NHI controls Inventory every embedded agent, its token type, and its authorization scope. Classify those credentials as NHI assets so ownership, expiry, and offboarding are explicit rather than implied.
• Separate governance from enforcement Document which controls define permitted agent behaviour and which controls can interrupt a live session. If a control only records or alerts, do not count it as runtime protection.
• Constrain agent tool access by session context Tie allowed tools to the active task and context, not to a broad standing role. Re-evaluate scope whenever the session sequence changes or the agent attempts a new action path.
• Detect shadow agents and shadow APIs Look for agents that connect through local tools, direct API calls, or integrations that never passed through the governance layer. Feed those findings into the same inventory and review process as registered agents.
• Prepare inline containment for agent abuse Define the conditions that terminate a session, isolate an agent, or block a tool call before the action completes. The response model should be able to act while the workflow is still running.

Key takeaways

• AI agent security describes governance and observability, but it does not stop a harmful session once the agent is already in motion.
• Runtime enforcement matters because authorized agent actions can turn malicious after access is granted, without a visible authorization failure at the call level.
• Teams need session-aware containment, not just logs and policies, if they want to interrupt agent abuse before the workflow completes.

Key terms

• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Agentic security: The practice of governing software actors that can choose actions, tools, and timing in production workflows. It extends identity, authorization, logging, and lifecycle control to agents so their behaviour is tied to a verifiable principal and a revocable permission set.
• Session context: The surrounding authentication and access conditions attached to a login, such as MFA status, device trust, IP reputation, and prior behaviour. It matters because identity risk is rarely decided by one event alone; context shows whether the event fits the account’s normal pattern.
• Shadow Agent: An AI agent deployed without formal registration, identity governance, or security oversight, the agentic equivalent of shadow IT. Shadow agents are more dangerous than typical shadow NHIs because they actively take actions using their credentials.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.