TL;DR: AI agents can accelerate analysis and bounded refactoring in a multi-million-line Go monolith, but they fail quickly when sequencing, invariants, or context are incomplete, according to 1Password. The deeper lesson is that production governance depends on explicit constraints, because agentic execution still breaks when intent must be inferred at runtime.
At a glance
What this is: This is a 1Password analysis of agentic refactoring in a live production codebase, showing that agents are useful for bounded changes but quickly fail when ordering, invariants, or context are not fully specified.
Why it matters: For IAM and identity teams, the lesson is that autonomous-seeming execution still needs explicit boundaries, because governance breaks when runtime decisions are left to inference rather than policy.
Context
AI agentic refactoring means using AI agents to analyse a codebase, plan changes, and execute bounded edits across multiple files or modules. In this article, 1Password uses that pattern to test where production-grade engineering tasks remain well within human governance and where they become brittle when left to runtime interpretation.
The central governance issue is not code generation speed. It is whether a production system can preserve security, privacy, performance, and reliability properties when change sequences must be correct, reversible, and explicitly constrained. That same question matters in identity programmes when agent-driven workflows touch privileged systems or trust boundaries.
Key questions
Q: What breaks when AI agents are allowed to infer change order in production systems?
A: Sequencing errors become correctness failures, especially in schema migrations, dependency rewrites, and service extraction. If an agent can decide the order from partial context, it may create silent data loss or irreversible state changes. The safe pattern is to make ordering explicit and machine-readable before execution begins.
Q: Why do deterministic artefacts reduce risk in agentic refactoring?
A: Deterministic artefacts turn an agent from an interpreter into a bounded executor. Manifests, templates, and analyzers create a stable reference point, so the system can verify changes against known constraints instead of trusting the model’s best guess. That reduces ambiguity and makes review and rollback far more reliable.
Q: What are the signs that an agentic workflow is too underspecified?
A: Common signs include speculation about identifiers, incorrect assumptions about ownership, skipped ordering constraints, and repeated need for rollbacks after apparently reasonable changes. If the agent starts filling gaps rather than asking for clarification, the specification is too weak for production use.
Q: How should teams govern parallel AI agent work safely?
A: Parallelism only works when the work is already isolated. Teams should separate tasks into non-overlapping worktrees or equivalent boundaries, define ownership clearly, and ensure that one agent cannot create conflicts that another must repair. Without that structural isolation, concurrency increases inconsistency instead of speed.
Technical breakdown
Sequencing constraints in agentic refactoring
Agentic refactoring works best when the change order is knowable before execution begins. In the article, the team used code analysis, SQL parsing, and runtime coupling data to derive a deterministic extraction sequence for a large monolith. That matters because in live systems, ordering is not just project management. It is a correctness property that can determine whether a migration preserves data integrity and service boundaries. When the sequence is explicit, agents can execute repeatable edits. When it is not, they tend to improvise in ways that look reasonable but break downstream assumptions.
Practical implication: define execution order as a hard constraint before agents touch production-bound changes.
Deterministic artefacts versus speculative interpretation
The article draws a sharp line between agents producing deterministic artefacts and agents acting as ongoing interpreters. The team found that agents were more reliable when they helped build analyzers, manifests, and templates that could then be reused as stable references. By contrast, when context was incomplete, the agent filled gaps with plausible but unverified assumptions, which the authors describe as speculation. In production environments, that distinction is critical: stable artefacts reduce ambiguity, while open-ended interpretation increases the chance of silent failure and rollback.
Practical implication: use agents to generate governed artefacts, then constrain follow-on execution to those artefacts.
Parallel execution and isolation boundaries
Parallel agent execution only works when the underlying work is already isolated. The article shows that multiple agents can accelerate a migration when their tasks are independent and collisions are structurally removed, for example through separate worktrees and tightly scoped templates. Without that isolation, concurrency creates more inconsistency, not less. For identity practitioners, the same logic applies to any delegated change process: throughput gains are only safe when ownership, scope, and rollback paths are fixed ahead of time.
Practical implication: treat isolation as a prerequisite for parallel agent work, not an optimisation to add later.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic refactoring exposes an assumption collapse in production governance: access and change control were designed for work whose sequence and intent are knowable before execution. That assumption fails when an AI agent fills context gaps at runtime and chooses its own micro-steps inside a broader task. The implication is not simply more automation discipline, but a rethinking of which decisions can remain implicit in production change paths.
Deterministic tooling, not free-form agent behaviour, is the real scaling pattern. The article shows that agents become useful when they are pushed into artefact production, then fenced by manifests, templates, and analyzers. That pattern aligns with how robust identity programmes already behave: policy defines the boundary, execution follows the boundary, and anything ambiguous is forced back into review. Practitioners should see agentic refactoring as governance-first engineering, not model-first productivity.
Incomplete specifications are governance failures, not just engineering misses. When an agent spec leaves ordering, invariants, or escalation undefined, it silently creates an implicit policy. In identity terms, that is the same class of problem that appears when privilege, delegation, or offboarding rules are assumed rather than encoded. The field should treat ambiguity as the failure mode, because ambiguity is where agentic systems invent their own control plane.
Identity blast radius becomes the decisive concept once agents enter production workflows. The article’s strongest lesson is that the unit of risk is no longer the change itself, but the scope of side effects an agent can generate before a human notices. That is a direct signal for NHI and agentic governance: if the workflow cannot bound the actor’s reach, the control model is already behind the execution model.
Human oversight remains necessary, but it must move upstream. The authors describe engineers as responsible for boundaries, dependency modelling, and sequencing, while agents handle well-specified execution. That division is the correct operating model for now. The practitioner conclusion is clear: oversight that arrives after the agent has already guessed is not governance, it is cleanup.
From our research library:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
- Read next: Agentic AI Identity Guide
What this signals
Identity blast radius: once AI agents can act inside production workflows, the critical question becomes how far a single delegated task can move before a human can intervene. That shifts governance from approval after the fact to boundary-setting before execution.
The practical signal for IAM and platform teams is that agentic workflows need explicit permission envelopes, short-lived execution windows, and tightly defined escalation paths. Traditional review cadences are too slow if the system can speculate and complete multiple steps before the next control point.
The article also reinforces a broader operating pattern: agents are most reliable when they create deterministic artefacts and least reliable when they are allowed to invent missing context. Programme design should therefore separate analysis, execution, and exception handling into distinct control stages.
For practitioners
- Define sequencing constraints before execution Require explicit ordering for schema changes, dependency rewrites, and deployment steps so agents cannot infer safe order from partial context.
- Constrain agents to deterministic artefacts Use agents to build manifests, analyzers, and templates, then execute only against those governed outputs rather than open-ended prompts.
- Treat ambiguity as an escalation condition Stop agent runs when invariants, identifiers, or ownership cannot be verified and route those cases to human review instead of allowing speculation.
- Isolate parallel work before scaling agents Only run concurrent agent tasks when worktrees, ownership boundaries, and rollback paths eliminate collisions across changes.
- Review runtime access boundaries for agentic workflows Map which production actions an agent can reach, how long those permissions persist, and where human approval must remain in the path.
Key takeaways
- AI agents are useful in production change work only when the task sequence, invariants, and rollback conditions are explicit.
- The article’s strongest lesson is that ambiguity creates implicit policy, and implicit policy is where agentic systems become unsafe.
- Governance improves when agents are constrained to deterministic artefacts and human review is reserved for exceptions, not guesses.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic refactoring raises questions about what an agent can change inside production boundaries. |
| ASI02 — Tool Misuse | The article shows why tool use must remain bounded by explicit execution rules. | |
| Recommendation — Constrain agent privileges so runtime execution cannot expand beyond the task boundary. Limit agent toolchains to approved operations and stop runs that drift outside specification. | ||
| NIST AI RMF | MANAGE — AI Risk Management | The core issue is managing operational AI risk in live engineering workflows. |
| Recommendation — Define escalation, oversight, and containment rules for AI-assisted production changes. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agentic workflows still depend on explicit authorization boundaries. |
| Recommendation — Review agent permissions so delegated execution stays within approved entitlements. | ||
Key terms
- Agentic Refactoring: The use of AI agents to analyse, plan, and execute code changes across a live system. In security terms, the risk is not just code generation, but machine-led sequencing, dependency inference, and change execution inside production boundaries.
- Deterministic Artifact: A stable output such as a manifest, analyzer result, or plan file that can be reviewed, versioned, and repeatedly validated. For agentic systems, deterministic artefacts matter because they replace model interpretation with something the organisation can govern.
- Sequencing Constraint: A required order for operations that must be preserved to avoid breaking data integrity, deployment flow, or service behaviour. In AI-assisted production work, sequencing constraints are governance controls because they define what must happen before anything else can safely proceed.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org