AWS agentic AI scope matrix exposes the governance gap

At a glance

What this is: This analysis explains AWS's Agentic AI Security Scoping Matrix and finds that agent risk is driven by granted authority and human oversight, not by who owns the underlying AI stack.

Why it matters: IAM, IGA, PAM, and security teams need a classification model that matches how agentic AI behaves at runtime, or they will overestimate the protection offered by static approval and inventory processes.

Context

Agentic AI changes the identity question from who owns the system to what authority the system has been granted. Once an agent can plan tasks, call tools, and act on external systems without a human at each step, existing governance models that only track the AI stack miss the operational risk boundary.

The governance gap is especially visible when autonomy increases faster than oversight. The central issue is no longer model capability in isolation, but how much independent action the agent can take, which systems it can touch, and whether runtime controls still bound those actions.

Key questions

Q: What breaks when agent scope is defined by stack ownership instead of runtime authority?

A: The classification misses the actual risk boundary. Two agents can share the same model and infrastructure yet have very different exposure if one only advises and the other can initiate changes across external systems. Governance has to follow authority, oversight, and tool reach, not just ownership of the AI stack.

Q: Why do agentic AI controls need to be tied to autonomy and oversight?

A: Because autonomy changes the ceiling on what an agent can do before a human can intervene. If the agent can start work, call tools, and complete tasks with little review, then traditional approval and review cadences no longer describe the real control environment. Risk treatment must track that independence directly.

Q: What are the signs that agent authority is failing in production?

A: Look for long-lived tokens, shared credentials, missing approval logs, and audit trails that cannot attribute an action to the agent itself. If a team cannot tell who or what issued a delete, config change, or external message, governance is already failing.

Q: How should organisations govern autonomous agents that act on behalf of users?

A: They should require clear delegation, task-scoped permission, and continuous traceability back to a human creator. The goal is not to impersonate the user more perfectly, but to narrow what the agent can do, preserve auditability, and separate ordinary automation from high-risk action.

Technical breakdown

Agency versus autonomy in agentic AI scoping

Agency and autonomy are different control dimensions. Agency answers what the agent is allowed to change, read, or write, while autonomy answers how much of that work happens without human approval. An agent can have broad write access but low autonomy if every consequential action waits for review, or limited reach but high autonomy if it can initiate work on its own. That distinction matters because authority and execution independence do not fail in the same way. Scoping that ignores either one produces false confidence about the agent's real operating envelope.

Practical implication: Separate permission scope from execution autonomy before approving any agent deployment.

Why runtime enforcement must sit outside the model

A model can be instructed to respect boundaries, but it cannot reliably enforce them. That is why deterministic controls need to live outside the reasoning loop, in infrastructure-level policy, scoped credentials, and tool gating. Once an agent can choose tools and act against external systems, prompt-based restraint is too weak to serve as the primary control. The practical design point is to constrain what the agent can invoke, what data it can reach, and how far a mistake can spread, regardless of the model's output quality.

Practical implication: Place tool permissions and data boundaries outside the agent so the model cannot override them.

Scope matrices as governance evidence, not just architecture

A scoping matrix becomes useful when it creates evidence that risk committees can defend. The value is not only in naming four levels of agency, but in documenting what was approved, who owns the agent, which systems it can touch, and what evidence is required before autonomy expands. That turns agent governance into a repeatable decision model rather than an ad hoc review. It also creates a common language for security, risk, and business owners when a deployment moves from recommendation to independent execution.

Practical implication: Use the matrix as a formal approval record for any increase in agent authority.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI scope cannot be governed by stack ownership alone: The article's central point is that two agents on the same model can present very different risk because one recommends and the other executes. That breaks the old assumption that AI risk can be classified by infrastructure provenance instead of runtime authority. The implication is that identity governance for agents must treat authority as the primary variable, not just deployment context.

Access review logic collapses when authority is dynamic: Traditional review cycles assume privileges persist long enough to be inspected, certified, and remediated. Agentic systems can acquire, use, and narrow authority in ways that do not fit that cadence, especially when tools and triggers change faster than governance artifacts. Practitioners should therefore treat authority change as a live governance event, not a periodic review item.

Runtime enforcement is the real control plane for agentic risk: The governance gap exists because prompts and policy language are not enforcement. Deterministic guardrails, scoped identities, and tool-level controls are the only controls that can bound behavior once an agent starts chaining actions across systems. That makes runtime containment the practical dividing line between acceptable supervision and unbounded autonomy.

Delegation-chain traceability: The article makes clear that boards and regulators need to see which human approved an agent's action path, not just that an agent was monitored. That is a governance assumption collapse in its own right: accountability cannot stop at the model when authority is delegated through tool use and downstream systems. Practitioners should design records that preserve human ownership across the full delegation chain.

Agentic risk classification needs its own named category: The most useful contribution here is the move from generic AI governance to a specific scope matrix for agentic systems. That creates a distinct language for assessing tools, oversight, and escalation without overloading human IAM or classic machine identity models. The practical conclusion is to classify agent deployments by authority and oversight before they are allowed into production.

From our research library:

• 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
• Read next: Agentic AI Identity Maturity Model

What this signals

Scope-based governance is becoming the minimum viable model for agentic AI: As organisations add more agents, the control question shifts from model quality to the authority each agent can exercise. The practical test is whether a deployment can still be bounded after a new tool, connector, or trigger is added, or whether the scope silently expands with it.

Agent identity and tool reach have to be governed together: A scope matrix only works if inventory, approval, and runtime controls are connected. Without that linkage, the organisation can still have a compliant-looking record while the live system behaves outside the approved boundary.

69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey: that is the right signal to stop treating agent governance as a variant of application access review and start treating it as a distinct runtime identity problem.

For practitioners

• Inventory agent identities and tool connections Record each deployed agent, its MCP or other tool connections, the systems it can read and write, and the human owner responsible for the deployment. Treat new plugins, tool servers, and embedded automations as changes to scope, not just inventory hygiene.
• Classify agents by agency and autonomy Use separate judgments for what the agent is permitted to change and how much runs without human approval. Promote scope only when the evidence shows the agent behaves within bounds and the approval model is still meaningful.
• Move enforcement out of the model Apply deterministic policy, scoped credentials, and tool-level allow or block controls outside the agent's reasoning loop. Do not rely on prompts or the model's self-restraint to contain access to external systems.
• Tighten oversight for high-consequence actions Require human approval for actions that commit funds, touch regulated data, or trigger destructive changes, even if the agent can otherwise operate independently. Calibrate review to consequence rather than the number of actions.
• Preserve delegation-chain audit trails Log which human initiated the agent action, which tools the agent used, and which downstream systems were affected so ownership remains traceable after execution. Use those records to support exception handling, recertification, and regulator review.

Key takeaways

• Agentic AI governance fails when teams classify systems by model ownership instead of the authority the agent can exercise.
• The matrix described in the article separates read-only advice, human-approved action, supervised autonomy, and full agency.
• The practical control move is to bind agent permissions, approvals, and runtime enforcement to the same scope decision.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Agency: Agency is what an identity is allowed to do, on whose behalf, with what scope, and for how long. For autonomous or semi-autonomous systems, this is more important than login status because the control problem is about delegated action, not mere authentication.
• Autonomy: Autonomy is the ability of a system to operate independently using internal state and context rather than relying on a fixed instruction for every move. For security teams, autonomy increases the need for scoped permissions, runtime review, and clear revocation paths because the system can act on its own.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.