TL;DR: Enterprise AI crossed from copilots into production infrastructure in 2025, with agents, MCP, and governance moving into core systems as firms operationalised execution, control, and accountability, according to Akto. The central issue is no longer whether AI is used, but whether organisations can see, scope, and govern what these systems can do before they act.
At a glance
What this is: Akto says 2025 was the year AI moved from copilots into enterprise infrastructure, with agents, MCP, governance, and operational control becoming the defining themes.
Why it matters: IAM and security teams now have to govern what AI systems can reach, do, and delegate in production, not just what model or interface they use.
Context
AI infrastructure is the shift from isolated copilots to systems that can execute work across enterprise tools, data, and workflows. In this article, AI infrastructure means agents, MCP-connected tools, and governance controls moving into production environments where identity and access decisions now affect real business operations.
The security gap is that traditional review cycles were designed for software that is configured before it runs, not systems that can acquire tools, call services, and alter scope during execution. Akto frames 2025 as the year that gap became operationally visible, and 2026 as the year governance becomes the deciding control plane.
Key questions
Q: What breaks when AI agents can chain tools through MCP without tight policy controls?
A: What breaks is the separation between request, authorisation, and execution. A single agent session can move from one system to another, combine partial permissions, and create a wider blast radius than any individual entitlement suggests. Traditional access reviews miss this because they rarely model chained tool behaviour in real time.
Q: Why do autonomous AI workflows increase the need for stronger identity and permission controls?
A: Autonomous workflows can execute decisions faster than humans can review them, which magnifies the impact of excessive access or weak governance. If an agent is compromised or mis-scoped, it can move across tools, data, and environments quickly. Strong identity controls limit blast radius, preserve trust boundaries, and make automated action defensible under audit.
Q: How should security teams govern AI-enabled workflows that can act on their own?
A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.
Q: How can organisations prove their AI controls are actually working?
A: Look for evidence that policy decisions are logged, sensitive prompts are being redacted or blocked when required, and approved AI interactions are traceable by identity and business context. Effective programmes produce audit-ready records, not just policy text. If the control cannot explain what happened in a session, it is not operational enough.
Technical breakdown
Why MCP turned AI access into an identity problem
MCP, or Model Context Protocol, lets agents connect to tools and data sources through standardised interfaces. That makes the access question bigger than model choice, because the risk now sits in what the agent can reach, which servers it can call, and how those connections are governed. When MCP servers are exposed through URLs or reused across environments, the trust boundary moves from the model to the integration layer. That creates the same governance pressure seen in NHI programmes: discover the credentialed path, define scope, and control revocation.
Practical implication: inventory MCP endpoints as governed access paths, not just development utilities.
Agent execution creates a control gap between approval and action
An AI agent is not merely a tool caller when it can decide what to do, select tools, and execute without human gating. That shifts authorisation from static provisioning to runtime control, because the meaningful risk is not whether access exists, but whether action can happen before review. In identity terms, least privilege becomes harder to define when intent emerges during execution rather than beforehand. For governance teams, this is where agent identity intersects with NHI patterns, because the system behaves like a workload identity with decision authority rather than a passive application account.
Practical implication: scope permissions to the narrowest executable task, not the broadest possible agent role.
Governance now has to precede agent behaviour, not follow it
The article's central shift is that boards and enterprises no longer treat AI as a pilot-only capability. Once agents are embedded in ERP, engineering, commerce, and analytics systems, the relevant question becomes which policies stop an action before it reaches production state. That changes control design from post-event monitoring to pre-execution policy, approval logic, and accountable ownership. The same pattern appears across human IAM, NHI governance, and emerging agentic AI controls: if the system can act in live environments, the governance model must know what happens at the point of action.
Practical implication: move policy enforcement to the point where the agent requests or combines access.
NHI Mgmt Group analysis
MCP is no longer a transport detail; it is an access plane. Once agents can connect to external tools through shared protocol interfaces, the security question shifts from model capability to reachable systems. That means discovery, approval, and revocation matter more than interface novelty. Practitioners should treat MCP inventory and trust scope as core identity governance, not optional architecture metadata.
AI infrastructure collapses the assumption that access can be governed after deployment. Traditional IAM assumes a stable subject, a known privilege set, and a reviewable state. That assumption fails when an agent can select tools and execute work at runtime, because the relevant permission state may only exist for seconds. The implication is that governance must move closer to issuance and execution boundaries.
Enterprise AI now creates a new blast-radius problem for identity teams. Once AI systems are embedded in finance, commerce, engineering, and operations, a single over-scoped integration can expose data, actions, and downstream automation across multiple business functions. That aligns with NHI governance more than classic application security, because the failure mode is not just code exposure but delegated operational reach. Practitioners need to think in terms of controlled execution surfaces.
Control, not adoption, is becoming the differentiator in AI programmes. Akto's 2025 framing shows the market has moved past experimentation and into governance-heavy deployment. That puts identity, security, and risk teams in the same decision loop for AI that they already manage for privileged human access and machine identities. The organisations that can enumerate, scope, and revoke AI reach will be the ones able to operationalise it safely.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: Agentic AI Identity Guide
What this signals
AI infrastructure governance now starts with reachable systems, not model selection. Once agents can call external tools and services, the real boundary is the set of systems they can touch and the approvals that govern those touchpoints. Security teams should push discovery and policy down to that access layer before usage scales further.
Runtime control is the new identity control for agentic environments. The old assumption that access can be reviewed after it is granted no longer holds when an agent can acquire and release permissions within the life of a task. That means authorisation, observability, and offboarding all need to move closer to execution time.
For practitioners
- Audit AI tool reachability Map every agent, MCP endpoint, and delegated tool path to the systems and data they can reach, then classify each path by business criticality and revocation owner.
- Constrain runtime authorisation Use task-scoped permissions that expire with the workflow so the agent cannot retain broader access than the specific action requires.
- Require pre-action policy gates Move approval, policy enforcement, and exception handling to the point where the agent requests execution, not after a downstream log review.
- Inventory third-party skills and servers Treat external skills, hosted tools, and managed MCP servers as supply-chain dependencies that need versioning, owner assignment, and offboarding control.
Key takeaways
- AI's shift into enterprise infrastructure changes the primary security problem from model usage to governed execution and reachability.
- The article's evidence points to agents, MCP, and production workflow integration as the places where control gaps now emerge.
- Practitioners should prioritise inventory, scoping, and revocation of AI tool access before adoption outpaces governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST Zero Trust (SP 800-207) sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Agents and MCP servers create new identity trust points that can be reached dynamically. |
| NHI-05 — Overprivileged NHI | The article centres on AI systems acting with permissions wider than their task scope. | |
| Recommendation — Classify every MCP connection as an authentication boundary and restrict it to the minimum approved scope. Reduce agent permissions to task-scoped access and remove standing privilege from production workflows. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The core risk is agents exercising more access than governance intended during runtime. |
| Recommendation — Map agent permissions and tool paths to ASI03 and block any runtime privilege expansion. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Agent and MCP reachability can extend credentialed access across connected enterprise systems. |
| Recommendation — Hunt for agent-driven credential use that expands laterally across tools and enterprise services. | ||
| NIST Zero Trust (SP 800-207) | Least privilege and continuous verification | The article emphasises continuous control over dynamic access paths, a Zero Trust concern. |
| Recommendation — Apply continuous verification to every AI tool request and deny any access path without current approval. | ||
Key terms
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Runtime control: Controls that enforce policy while an AI system is operating, rather than after the fact. For healthcare chatbots, runtime control includes data masking, output filtering, access scoping, and immutable logging so the organisation can defend the interaction itself.
- Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org