AI risk management now needs identity-aware controls for agentic systems

At a glance

What this is: Akto’s guide says AI risk management must move beyond static, pre-launch controls because agentic systems introduce dynamic threats such as prompt injection, data poisoning, leakage, and tool abuse.

Why it matters: This matters because AI governance now overlaps with identity and access decisions for agents, so IAM and security teams need controls that govern runtime behaviour, not just model approvals.

Context

AI risk management is no longer just about model quality or compliance paperwork. Once systems can call tools, access data, and act on their own, the governance problem expands into authentication, authorisation, monitoring, and control of machine-like behaviour across the AI lifecycle.

The article’s central issue is that traditional risk frameworks assume fixed systems and stable approval points. Agentic AI breaks that assumption because privileges, inputs, and actions can shift at runtime, which makes identity-aware controls part of the AI governance baseline rather than a specialist add-on.

Key questions

Q: What breaks when an AI agent is given real user sessions and tool access?

A: The main failure is that a single injected instruction can inherit the user's active permissions and convert a reading task into exfiltration, command execution, or message sending. When browser cookies, connectors, and desktop access are all in scope, the agent's effective identity becomes the security boundary, not the model itself.

Q: Why do AI agents require different risk controls than static applications?

A: AI agents can make decisions in real time, follow instructions embedded in prompts, and call tools without a fixed path through the system. That means the main risk is not only code defects but also behavioural manipulation, privilege misuse, and unexpected downstream actions.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.

Q: How should organisations govern AI agents that need database access?

A: Organisations should give AI agents narrow read access by default, separate write privileges from query privileges, and require human approval for any session that can modify data. That keeps agent activity inside a clearly bounded role while preserving auditability and reducing the chance of unsupervised state change.

Technical breakdown

Why traditional risk frameworks miss agentic AI

Traditional IT risk frameworks are built for static code, known change windows, and predictable approval flows. Agentic systems behave differently because they can make decisions in real time, invoke tools, and change action paths based on context. That creates a control problem for pre-launch testing alone: the system may be safe in review and unsafe in operation. In practice, the failure is not just technical drift. It is governance drift, where the original control assumptions no longer match the runtime behaviour of the system.

Practical implication: Treat runtime identity and authorisation as control points, not just model design concerns.

Identity-aware controls for AI agents and tool use

When an AI agent can call APIs, read data, or trigger workflows, it starts to resemble a non-human identity with delegated authority. That means access scope, credential handling, and session boundaries matter as much as prompts and model outputs. The article’s point about passwords and access controls is important because those controls must be adapted to the agent’s action model. A tool-using agent should not inherit broad standing access just because it sits inside a trusted application boundary.

Practical implication: Constrain agent privileges to task-scoped access and review every delegated tool path.

Continuous testing, telemetry, and guardrails

AI risk management needs continuous validation because threats emerge after deployment, not only before it. Prompt injection, data poisoning, leakage, and abnormal agent behaviour are detected through adversarial testing, runtime telemetry, and policy enforcement around inputs, outputs, and tool calls. This is especially important when agents connect to databases or APIs, where a single compromised decision can have immediate downstream impact. The control model shifts from one-time assurance to ongoing behavioural assurance.

Practical implication: Combine red teaming, monitoring, and policy checks to catch agent misuse as it happens.

Threat narrative

Attacker objective: The attacker aims to coerce the AI system into leaking data, misbehaving, or taking unauthorized actions through trusted agentic workflows.

1. Entry occurs through manipulated prompts, poisoned training data, or other deceptive inputs that cause the AI system to accept hostile instructions as legitimate context.
2. Credential or privilege abuse follows when an agent uses its delegated access to call tools, query data, or execute actions beyond the intended business purpose.
3. Impact emerges as the system leaks private data, takes unauthorized actions, or produces harmful outputs that affect business operations and user trust.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-aware AI risk management is now a governance requirement, not a specialist enhancement. Once agents can act, access, and delegate, the risk domain shifts from model behaviour alone to the control of non-human authority. That makes identity, privilege, and runtime access part of the same governance conversation as red teaming and model monitoring. Practitioners should treat agent identity as a first-class design and audit concern.

Agentic AI creates a control gap because many organisations still govern risk as if access were static. A human user can be reviewed after the fact, but an agent may acquire, use, and release access inside a single task. That compresses the control window and weakens traditional review logic. The specific failure mode is standing trust in delegated automation, and that needs to be named directly in governance reviews.

Continuous telemetry is the operational anchor for AI governance debt. The article’s emphasis on monitoring, drift, and policy violations reflects a broader truth: once AI behaviour changes over time, pre-deployment sign-off cannot carry the full assurance burden. Security leaders should assume their current controls will miss runtime misuse unless they instrument agent actions, inputs, and downstream effects.

The strongest frameworks here are NIST AI RMF and ISO/IEC 42001, but identity teams must still bridge in NHI thinking. The article is really about lifecycle governance for systems that behave like delegated actors, which means AI controls and access governance need to converge. Practitioners should align AI risk oversight with delegated access rules, auditability, and accountability for machine-like actors.

Agentic AI identity drift is the right named concept for this problem space. As agents move between prompts, tools, and data sources, their effective identity can shift faster than conventional governance can track. That drift is what turns useful automation into an unreviewable access path. Teams should design for identity continuity across the agent lifecycle, not only model correctness.

From our research library:

• Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
• Read next: Agentic AI Identity Guide

What this signals

Agentic AI governance now depends on identity continuity. Once an agent can move between prompts, tools, and data sources, the old assumption that access can be reviewed after use no longer holds. Identity governance has to track delegation, scope, and runtime behaviour together, or the control plane will lag the system it is meant to govern.

67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey. That is exactly the kind of trust model that becomes brittle when an agent can act autonomously across multiple tools and datasets.

AI governance debt is the accumulation of controls that were designed for fixed systems but deployed against adaptive ones. The longer organisations delay runtime monitoring, adversarial testing, and access scoping for agents, the more likely they are to discover their control assumptions only after an incident.

For practitioners

• Define agent inventory and ownership Catalogue every AI system, including LLMs, RAG pipelines, AI agents, and AI-powered features. Record what data each system accesses, who owns it, and whether it can act autonomously or only under human review.
• Scope delegated access for every agent Treat each agent as a non-human identity with a narrow purpose and limited tool permissions. Remove standing access where possible and tie credentials, tokens, and API permissions to the smallest viable task boundary.
• Build continuous adversarial testing into operations Test prompt injection, data poisoning, leakage, and harmful tool execution on an ongoing basis. Pair red teaming with telemetry that tracks inputs, outputs, policy violations, and unusual agent behaviour after deployment.
• Separate approval from runtime assurance Use pre-deployment review for design approval, but do not treat it as a substitute for runtime controls. Require monitoring and audit records that show how the system behaves once integrated with APIs and data sources.
• Align AI governance with identity governance Bring IAM, security, and AI owners into the same operating model so delegated authority, ownership, and offboarding are covered together. The goal is to close the gap between model risk review and access governance.

Key takeaways

• Traditional AI risk programmes fall short when agents can decide, call tools, and access data at runtime.
• The article highlights prompt injection, data poisoning, leakage, and tool abuse as the main risk patterns to govern.
• The control shift is from one-time approval to continuous monitoring, task-scoped access, and adversarial testing.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Data Poisoning: The deliberate or accidental contamination of a data source that influences system behaviour. In AI environments, poisoned content can alter retrieval results, generated answers, or downstream decisions, which makes write access, change monitoring, and source integrity part of the identity control problem.
• AI Risk Management: AI Risk Management is the discipline of identifying, assessing, treating, and monitoring risks created by artificial intelligence systems. It covers model behavior, data quality, misuse, security, privacy, compliance, and operational impact, with controls applied across the AI lifecycle from design and training through deployment, monitoring, and retirement.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to govern delegated access, machine identities, and agent behaviour across real environments.