AI agents in SaaS are creating a new NHI trust gap

At a glance

What this is: This is an analysis of how AI agents in SaaS environments create a new NHI trust gap when experimental access becomes persistent, overprivileged production access.

Why it matters: It matters because IAM, PAM and NHI teams need to govern agent identity, OAuth scope, token lifetime and SaaS-to-SaaS trust before temporary access becomes permanent exposure.

By the numbers:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.

Context

AI agents in SaaS environments are non-human identities that authenticate, take actions and carry delegated access across applications. The governance problem is not simply that they exist, but that teams often approve them while still treating them like temporary experiments, which leaves access scope, ownership and offboarding unclear once the agent moves into production behaviour.

The article’s core warning is that trust decisions made during testing tend to survive long after the original use case changes. That creates a control gap across NHI inventory, OAuth governance, token lifetime management and cross-application privilege review, especially where SaaS-to-SaaS connections and MCP-driven workflows hide the full access path.

Key questions

Q: What breaks when AI agents are granted SaaS access for testing and never reviewed again?

A: Temporary approvals become permanent delegated trust, which means the agent keeps scopes, tokens and service-account access long after the original experiment ends. That breaks least privilege at the lifecycle level and creates hidden production authority that security teams may not revisit until after the agent is already embedded in business workflows.

Q: Why do AI agents increase risk in SaaS environments?

A: AI agents increase risk because they can operate through existing application permissions and continue using them as tasks change. That turns delegated access into a broader governance problem, especially when the permissions were never reviewed for non-human use. The result is a larger blast radius from the same underlying grant.

Q: How can security teams tell whether AI agent access is drifting out of scope?

A: Look for agents touching systems, data sets, or tools that are outside the intended task boundary, especially when those actions are not part of the approved workflow. Behavioural baselines, entitlement logs, and cross-system correlation are the key signals. If the agent can act meaningfully outside its original purpose, scope drift is already happening.

Q: Should organisations treat agent access reviews the same as human access reviews?

A: No. Human reviews focus on role, business need, and employment status, while agent reviews must also cover tool scope, credential inheritance, and downstream action paths. The review object is not just the agent itself but the full execution chain it can initiate. That distinction matters because agent behaviour can change faster than a standard recertification cadence can capture.

Technical breakdown

How AI agents inherit SaaS access through non-human identities

AI agents rarely connect to SaaS on their own terms. They inherit access through OAuth grants, API tokens, service accounts and SaaS-native integrations that create a chain of delegated trust. Each connection defines who the agent is, what it can reach and how long that access remains valid. In practice, the risk is not only credential exposure but also the quiet expansion of authority as new integrations are layered on top of old approvals. Once an agent can create records, move data or trigger workflows, its identity posture must be treated as operational access, not experimentation. Practical implication: govern every agent as a living non-human identity with explicit ownership and expiry.

Practical implication: govern every agent as a living non-human identity with explicit ownership and expiry.

Why temporary trust becomes permanent access

The article describes a common SaaS security failure pattern: access granted for testing is rarely revisited after the agent proves useful. That means least privilege is assessed at the start, then ignored as scope expands in production. Long-lived tokens, unreduced OAuth scopes and shared service accounts become the evidence trail of that drift. The control failure is not only weak review cadence, but also the assumption that experimental access will naturally decay. Practical implication: align recertification and revocation workflows to agent lifecycle changes, not calendar-based hope.

Practical implication: align recertification and revocation workflows to agent lifecycle changes, not calendar-based hope.

SaaS-to-SaaS trust paths and MCP sessions amplify blast radius

When AI agents broker access between SaaS platforms, the trust path becomes multi-hop and harder to see. MCP sessions, cross-application OAuth grants and downstream automation can turn a single approval into broad operational reach across internal systems. That changes blast radius from a question of one credential to a question of accumulated delegated authority. Visibility gaps matter because security teams may know the agent exists without knowing every application chain it can traverse. Practical implication: map cross-SaaS trust paths before treating an agent as safely contained.

Practical implication: map cross-SaaS trust paths before treating an agent as safely contained.

Threat narrative

Attacker objective: The objective is to abuse accumulated delegated access in SaaS environments so one agent can influence multiple systems with more privilege than the original approval intended.

1. Entry occurs when an AI agent is granted OAuth, API or service-account access during an experimental SaaS integration.
2. Escalation follows as the agent’s permissions persist after the trial phase and expand into production workflows with broader scope than intended.
3. Impact occurs when retained access lets the agent create records, move data, change configurations or trigger workflows across connected systems.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agents in SaaS are exposing an NHI trust gap, not an AI novelty gap. The problem is that organisations are approving delegated access faster than they can govern it, then discovering that the resulting identity behaves like durable production access. That is why the issue sits squarely in NHI governance, not just SaaS posture management. Practitioners need to treat agent identity as a lifecycle problem with ownership, expiry and revocation tied to actual use.

Temporary trust assumptions are collapsing under agentic runtime behaviour. Access review processes assume privileges persist long enough to be observed, certified and removed. AI agents can acquire access during one phase of experimentation and keep using it long after the business no longer remembers the original approval. The implication is that governance has to move from periodic review to issuance-time control and lifecycle-bound trust.

Ephemeral trust debt is the right concept for this pattern. The debt starts when convenience approvals create access that nobody intends to own long term, then compounds as scopes, tokens and service accounts are reused across workflows. This is where OWASP-NHI concerns such as overprivileged NHI, long-lived secrets and insecure offboarding converge in one SaaS problem. Practitioners should recognise that every unresolved temporary grant becomes a future access exception.

Agentic SaaS governance now spans human IAM, NHI and workflow control in one operating model. A human may request the agent, an NHI may carry the authorization, and the SaaS platform may execute the action, but the trust decision is shared across all three layers. That makes compartmentalised ownership a liability. Security teams need a single control plane for agent inventory, SaaS trust paths and revocation accountability.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Ephemeral trust debt: temporary approvals for AI agents become long-term exposure when no one revalidates the original SaaS trust decision. That means the control problem is not adoption speed alone, but whether your governance model can revoke authority before an experiment turns into production dependency.

Agent inventory, OAuth governance and service-account ownership now need to converge in one operating model. If those controls live in separate teams, AI agents will keep accumulating access faster than recertification can remove it.

Security programmes that already track NHI lifecycle issues have the right starting point for SaaS agent governance. The missing piece is to align those controls to SaaS-to-SaaS trust paths and MCP-driven workflows before blast radius expands.

For practitioners

• Map every AI agent to an accountable owner Build an inventory of agents, the SaaS apps they touch, and the non-human identities they use. Require one named business and security owner for each agent so temporary experiments do not become ownerless production access.
• Review OAuth grants and token lifetimes together Audit scope, refresh token duration and downstream app-to-app trust as one control set. Reduce broad grants that were accepted during testing and revoke tokens that outlive the business purpose they were created for.
• Recertify agent access at lifecycle change points Trigger reviews when an agent moves from pilot to production, changes function, or is embedded in a new workflow. Do not rely on annual access reviews to catch agent drift.
• Separate experimentation from production authority Use constrained test tenants, scoped roles and explicit promotion steps before an agent can touch sensitive records or operational workflows. If the agent can change data or configurations, it should already be under production governance.

Key takeaways

• AI agents in SaaS create a governance gap when experimental access persists into production without fresh review.
• The article describes overprivileged OAuth grants, long-lived tokens and reused service accounts as the visible signs of that drift.
• Teams should govern agent access at lifecycle change points, not only through periodic certification cycles.

Key terms

• Ephemeral trust debt: Ephemeral trust debt is the accumulated risk created when short-lived access, credentials, or trust relationships are issued quickly and not fully governed. In practice, it appears when temporary permissions, tokens, or sessions outlive their intended purpose, lack clear ownership, or are not revoked, audited, or rotated with enough discipline.
• SaaS-to-SaaS Trust Path: A SaaS-to-SaaS trust path is the chain of delegated permissions that lets one application, integration, or agent reach another. The risk is cumulative because each hop can expand data access, action scope, and the eventual blast radius if the chain is compromised.
• AI Agent Identity Lifecycle Management: AI Agent Identity Lifecycle Management is the process of creating, governing, monitoring, rotating, and retiring identities used by autonomous software agents. It covers how an agent is authenticated, what it can access, how its credentials are issued and revoked, and how changes are tracked across its operational life to reduce misuse and drift.
• Non-Human Identity Sprawl: The uncontrolled growth of service accounts, tokens, certificates, bots and AI agents across systems. It becomes dangerous when teams can no longer inventory who or what holds access, which makes review, offboarding and least-privilege enforcement unreliable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.