TL;DR: AI agents turn machine identity from a scale challenge into a runtime governance problem, according to AppViewX, because valid certificates prove identity but do not control action, leaving enterprises with authenticated agents that can still overreach. The governance failure is assuming issuance-time trust can substitute for continuous, task-level authorization.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on AppViewX's blog post: AI agents force machine identity management beyond episodic certificate operations because authentication no longer governs real-time action.
Why it matters: IAM, PAM, and NHI programmes now need continuous discovery, runtime authorization, and ownership models that keep pace with agent behaviour rather than renewal dates.
By the numbers:
- AI agents will appear in 33% of enterprise software applications by 2028, up from less than 1% in 2024, according to Gartner research cited by AppViewX.
- Machine identities outnumber humans 82:1 in today’s enterprise environments, according to AppViewX.
Context
Machine identity governance breaks when the identity can keep acting after authentication without a fixed, human-paced review cycle. Certificates still matter, but they only prove who or what connected; they do not govern the behaviour that follows.
AI agents intensify that gap because they are continuous and adaptive rather than episodic. They create a need for agentic AI identity thinking that treats runtime authority, not just credential issuance, as the core control problem.
Key questions
Q: Why do AI agents change infrastructure identity governance?
A: AI agents change the model because they can take actions, call tools, and operate without a human approving each step. That means the identity is no longer just a credential holder. It becomes an execution authority that needs explicit scope, continuous monitoring, and a clean revocation path when behaviour drifts.
Q: Why is certificate validation not enough for agentic systems?
A: Certificate validation only proves a presented certificate is trusted and current. Agentic systems still need runtime controls at the moment of execution, because a valid certificate does not limit what an agent can call, which data it can read, or whether the credential has been over-scoped, replayed, or bound to the wrong workload.
Q: How should teams govern runtime access for machine identities?
A: Teams should govern runtime access with just-in-time permissioning, explicit ownership, and short-lived credentials tied to each machine identity. That means issuing tokens, certificates, or service account grants only for a defined task, then revoking them automatically after use, with approval and logging around privileged access and secret rotation.
Q: What happens when agents are deployed faster than identity reviews?
A: When agents are deployed faster than identity reviews, stale service accounts, tokens, and secrets accumulate with no clear owner or scope. That creates standing access, weak offboarding, and blind spots in access reviews, so the agent can keep using privileges long after the intended task, team, or control has changed.
Technical breakdown
Why certificate lifecycle alone cannot govern agent behaviour
Traditional certificate lifecycle management assumes a bounded identity with predictable issuance, renewal, and revocation moments. That model works for static workloads, but AI agents can spawn quickly, hold credentials while chaining actions across systems, and change their effective risk profile while a certificate remains valid. The important distinction is between authentication and authorization: a certificate can confirm identity, but it cannot decide whether a specific action is acceptable in the current context. Once the identity is valid, the old model has no native concept of task-scoped control. See the Machine Identity, PKI and Certificate Lifecycle Guide.
Practical implication: Treat certificate lifecycle as the trust foundation, not the full governance model, and design controls that evaluate action context after authentication.
Continuous discovery and runtime authorization for machine identities
Continuous discovery replaces periodic inventory updates with always-on detection of newly created agents and their permissions. Runtime authorization then evaluates each action as it happens, which is materially different from access reviews or renewal workflows. In practice, this shifts governance from directory-style record keeping to control-system behaviour: validate continuously, adjust dynamically, and intervene when risk changes. That architecture is necessary because agent deployments now move faster than manual onboarding, and their permissions often outlive the moment they were granted.
Practical implication: Move high-risk agent identities into live policy evaluation so permission scope can change with observed behaviour instead of waiting for review cycles.
The authentication-authorization gap in PKI
PKI establishes cryptographic trust by proving an identity is genuine, but that trust stops at the point of authentication. The gap appears when a valid identity can still perform actions that are too broad, too sensitive, or no longer appropriate for the current task. For AI agents, that gap is not theoretical because the same certificate that authenticates the actor can also permit unintended machine-speed activity across multiple systems. Governance therefore has to extend beyond proof of identity into decision-time enforcement. Read Guide to SPIFFE and SPIRE.
Practical implication: Instrument policies so that certificate validity never becomes a proxy for permission to act across sensitive workflows.
Threat narrative
Attacker objective: Abuse a trusted machine identity to perform unauthorized actions at machine speed without triggering controls that only verify authentication.
- entry: AI agents enter production with valid certificates or temporary credentials, which establishes trusted access without immediately constraining behaviour.
- escalation: broad entitlements let the agent chain actions across systems and exceed the narrow task that justified the original access grant.
- impact: the agent can expose data, touch production systems, or violate policy while still appearing authenticated and legitimate to the control plane.
Breaches seen in the wild
- Binance hack 2026: A compromised DevOps laptop gave access to a Binance service container that submitted about $6.3 billion in unauthorised withdrawals.
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI agents turn machine identity into a behavior problem, not just a scale problem. Static certificate operations were built for predictable workloads that could be issued, rotated, and revoked on schedule. AI agents act differently because they can adapt, chain actions, and continue operating after authentication. The consequence is that identity governance has to move from managing records to governing runtime decisions.
Certificate validity is now only the starting condition, not the control outcome. AppViewX's analysis shows the core gap clearly: cryptography proves identity, but it does not decide whether an action should be allowed. That breaks the old assumption that valid credentials imply acceptable behaviour. The implication is that access control for agents has to be evaluated at execution time, not inferred from issuance time.
Continuous discovery is the governance prerequisite that episodic onboarding cannot replace. AI agents appear too quickly for manual ticket-based provisioning, and they can already be operating before inventory catches up. That is a control problem, not a tooling convenience issue. Enterprises need a current view of what exists, who owns it, and what it can do right now.
Vendor-neutral security stacks are becoming less defensible than unified identity control systems. Cryptographic trust, identity governance, and behavioural enforcement solve different parts of the same problem, and separating them creates blind spots between layers. A platform that authenticates but cannot intervene still leaves the risk open. The field is moving toward runtime control planes because machine identity is now a live operational domain, not a back-office certificate ledger.
Runtime governance for agents should be read as an identity discipline, not an AI exception. The same lifecycle questions that govern workload identities now apply to agentic systems, but with tighter timing and higher action volatility. That means organisations should treat agent permissions, ownership, and intervention rights as first-class identity controls. The practical standard is continuous authority, not periodic reassurance.
From our research library:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Continuous validation will replace episodic identity administration for agentic systems. The control challenge is no longer just whether an identity exists, but whether its permissions still make sense as it acts. Governance teams should prepare for controls that react to behaviour as it unfolds, rather than waiting for scheduled review windows.
Runtime authorisation becomes the decisive control point once agents are in production. Access reviews cannot govern identities that request, use, and release privileges inside the same operational cycle. That pushes IAM, PAM, and NHI teams toward task-scoped intervention, especially where systems already depend on overprovisioned access.
Entity governance is the right framing for mixed human and machine estates. With machine identities outnumbering humans by 25x to 50x in modern enterprises, security programmes need a model that covers people, workloads, and agents under one governance lens. The practical implication is a single operating model for ownership, discovery, and intervention across all identity types.
For practitioners
- Implement continuous discovery for agent identities Maintain an always-current inventory of agents, their certificates, owners, and system reach so newly deployed identities are visible before they accumulate broad access.
- Separate authentication from action approval Use runtime policy checks for each agent action so certificate validity never functions as blanket permission across sensitive workflows.
- Right-size entitlements against observed behaviour Compare granted permissions with actual agent activity and reduce access where the task only needs narrow, time-bound scope.
- Define human ownership for every agent Assign an accountable owner for deployment, permissions, and intervention authority so no agent remains unmanaged after launch.
- Add intervention points for high-risk actions Design controls that can pause, step up, or terminate agent sessions when behaviour changes, especially for production or data-sensitive workflows.
Key takeaways
- AI agents expose a structural weakness in machine identity programmes because authentication alone cannot govern action.
- The issue is already operational, not hypothetical, since agents are being deployed with real permissions before matching controls exist.
- Continuous discovery, runtime authorization, and accountable ownership are the controls that matter most when identities act continuously.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · Agentic AI Identity Maturity Model · Ultimate Guide to NHIs: Key Challenges and Risks
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Agents in production are granted broader access than their actual tasks require. |
| NHI-07 — Long-Lived Secrets | The article centres on machine credentials that remain valid beyond the moment they should matter. | |
| NHI-04 — Insecure Authentication | Certificates authenticate the agent, but the article shows authentication alone cannot govern action. | |
| Recommendation — Reduce standing agent permissions and align access scope to observed task behaviour. Shorten credential lifetime and move issuance toward just-in-time use. Treat authentication as an entry control and pair it with runtime authorization. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential issuance, rotation, and revocation are central to the machine identity lifecycle described here. |
| Recommendation — Automate authenticator lifecycle events and remove stale credentials promptly. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The analysis focuses on rights that exceed what the agent should be able to do in context. |
| Recommendation — Continuously validate entitlements and adjust authorizations as conditions change. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The breach pattern is about trusted identities being used to move through systems and abuse access. |
| Recommendation — Map agent misuse to credential access and lateral movement to improve detection logic. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
- Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org