CIS companion guides bring ai agents and MCP into CIS controls

At a glance

What this is: Astrix Security describes CIS Companion Guides that extend the CIS Critical Security Controls to LLMs, AI agents and MCP environments, with the central finding that AI governance still depends on inventory, deterministic authorisation and NHI control.

Why it matters: IAM, PAM and NHI teams need this because AI agents already operate through service accounts, API keys and tokens, so governance gaps at the identity layer become enterprise-wide control failures.

Context

The security gap is not that AI systems lack controls altogether. The gap is that model, agent and protocol layers are often governed with inconsistent assumptions, even though they rely on the same identity and authorisation foundations as other enterprise systems.

The article frames AI adoption as a control-surface problem rather than a new framework problem. CIS is extending its existing controls to AI-aware environments, which means teams have to decide how inventory, deterministic authorisation and NHI governance apply when systems are not fully deterministic.

For identity programmes, the practical question is where control ownership sits across LLMs, AI agents and MCP tool access. If the access path is not governed as a non-human identity path, policy drift and unauditable actions become the default outcome.

Key questions

Q: What breaks when AI agents are managed like ordinary machine identities?

A: What breaks is the assumption that access scope can be fully understood from provisioning data and quarterly review. Ordinary machine identities are repeatable; agents are not. If teams only review entitlements, they miss context shifts, delegated actions, and credential creation inside the session.

Q: Why do AI agents need deterministic authorisation instead of model output approval?

A: Because model output is a recommendation, not a permission boundary. If the system that generates the action also decides whether it can execute, prompt injection or context manipulation can turn a suggestion into an unauthorised action. Deterministic authorisation keeps policy separate from the model’s text.

Q: What do security teams get wrong about role-based access for MCP?

A: They often assume that coarse roles alone solve the problem. In practice, roles must be paired with server-specific restrictions and explicit deny rules, otherwise broad grants can still expose destructive tools. The important decision is not whether to use RBAC, but how to narrow it where tool risk is highest.

Q: How should organisations prioritise AI inventory before expanding agent use?

A: Start with the systems, identities and connections that can actually execute actions: models, agents, clients, servers and their credentials. Once that map exists, teams can apply controls to the highest-risk paths first and avoid scaling blind spots into production.

Technical breakdown

Why deterministic authorisation matters for AI systems

The article’s core technical claim is that model output is not an authorisation signal. In deterministic systems, the control path separates suggestion from permission: the system can propose an action, but a governed policy must still decide whether it executes. That distinction becomes critical when LLMs or agents can call tools, write to memory, or touch sensitive data. Without it, prompt injection or context manipulation can change behaviour without changing policy. In practice, the question is not whether the model is intelligent enough, but whether the execution path is bounded by explicit identity and policy checks.

Practical implication: enforce deterministic authorisation at every action boundary, not at the model output boundary.

How NHI governance changes in agent and MCP layers

AI agents act through non-human identities such as API keys, service accounts, OAuth tokens and MCP server credentials. That means access scope, ownership, revocation and auditability are identity problems first, not model problems. The agent layer adds reasoning and action, while MCP adds tool mediation, but both still depend on credentials that define what can be read, written or executed. If those identities are over-privileged or poorly inventoried, the agent inherits the same blast radius. The governance challenge is therefore to treat each credential as an operational control point, not as a background integration detail.

Practical implication: inventory and scope every agent credential before you expand tool access or workload reach.

What the confused deputy problem looks like in AI

The confused deputy problem occurs when a higher-privileged system is nudged into performing an action on behalf of something less trusted. In the article’s framing, this is especially relevant to AI agents because tool use, memory and context can steer privileged actions without a human consciously approving each step. MCP can make that path more structured, but it does not remove the underlying risk if the agent can be induced to act outside its intended intent boundary. This is why privilege boundaries and tool allowlists matter as much as model safety controls.

Practical implication: separate prompting freedom from execution privilege so a lower-trust input cannot inherit higher-trust authority.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Spain's first AI agent data breach 2026: Spain's AEPD logged its first breach notification attributed to an attacker's AI agent, which altered personal data and accessed invoices.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI governance now inherits the identity problem, not just the model problem. The article is important because it puts AI security back into the language of deterministic authorisation, inventory and access scope. Once an AI system can act through service accounts, API keys or tokens, the question becomes who or what is actually authorised to do the work. Practitioners should read this as a governance reset: AI adoption succeeds or fails on identity control, not on model sophistication.

Model prompts, agent memory and MCP tool access are three different control planes. CIS’s split across LLMs, AI agents and MCP is not cosmetic. Each layer fails differently, so teams that try to secure them with one generic AI policy will miss the actual failure mode. The practical implication is that identity teams need to map which layer owns input handling, which owns decisioning, and which owns execution.

NHI governance is now the shared substrate for AI, SaaS and cloud control. The strongest signal in the article is that AI agents are not exempt from the same lifecycle rules that govern other machine identities. If the credential is unmanaged, the agent is unmanaged. If the tool path is unauditable, the action is unauditable. That makes NHI inventory, ownership and revocation core controls for AI programmes, not adjacent hygiene.

System prompts have become configuration drift risks. The article’s point that prompts are configuration, not content, deserves to be treated as a governance rule. When prompt text can alter policy outcomes, change control and versioning matter in the same way they do for infrastructure-as-code or access policy files. Security teams should treat prompt change management as part of the control surface they already govern.

Deterministic authorisation is the dividing line between safe automation and unsafe delegation. The guides reinforce a principle that now applies across human, NHI and AI workflows: the system that suggests an action must not be the system that authorises it. That is the right boundary for CIS-style control mapping, and it is the boundary most AI adoption plans still blur. Practitioners should design around that separation before scaling agentic use cases.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Identity ownership is the control boundary that AI adoption still lacks. The article reinforces that the practical risk is not AI in the abstract, but unmanaged access paths attached to AI systems. If teams cannot inventory the service accounts, API keys and tokens behind an agent, they do not have a governable deployment, only a functional one.

Deterministic authorisation is the right design response to agentic behaviour. When a model or agent can propose actions but not authorise them, security teams preserve the separation between decision support and execution rights. That distinction should shape programme design across IAM, PAM and NHI governance.

70% of organisations grant AI systems more access than they would give a human employee performing the exact same job. according to the 2026 Infrastructure Identity Survey That gap is the signal that access governance has not caught up with AI deployment speed.

For practitioners

• Inventory AI systems and their credentials Catalog LLMs, AI agents, MCP clients and servers, plus the service accounts, API keys and OAuth tokens they use. Assign ownership, purpose and revocation paths so each identity has a clear governance home.
• Separate suggestion from authorisation Require a deterministic policy check before any model, agent or tool call can read, write or execute against a secured resource. Do not treat model output as permission to act.
• Constrain tool access with allowlists Define the exact tools an AI agent or MCP client may invoke, then limit each identity to the minimum operations needed for the task. Review privilege boundaries whenever the workflow changes.
• Treat prompts as governed configuration Version, review and change-control system prompts, tool instructions and agent policies with the same discipline used for other configuration artefacts. This reduces silent policy drift in production AI workflows.

Key takeaways

• AI systems become governance problems as soon as they act through credentials, because access scope rather than model quality determines blast radius.
• The article’s control model depends on deterministic authorisation, so policy must sit between the model’s suggestion and the actual execution path.
• Inventory and ownership are the first practical controls for AI adoption because unmanaged NHIs make AI actions unauditable and hard to revoke.

Key terms

• Deterministic Authorization: Deterministic authorization means the same request, policy, and context always produce the same decision. That property matters because security teams need access controls they can reproduce during audits, investigations, and incident response. It is especially important when AI is involved upstream but not at the decision boundary.
• Confused Deputy: A confused deputy is a privileged system that is tricked into performing an action on behalf of an untrusted requester. In agentic AI, the agent may misread malicious input as legitimate intent and then use its own authority to act, which turns a logic problem into a security incident.
• MCP: Model Context Protocol, an open way for AI agents to connect to tools and data sources. It improves interoperability, but it also introduces a shared integration layer that must be governed carefully because the protocol can widen access across many systems at once.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.