Cisco Duo and Britive extend zero trust to human and agentic access

At a glance

What this is: This article argues that Zero Trust now has to reach beyond login into runtime access, with Duo handling identity assurance and Britive enforcing just-in-time privilege for human, non-human, and agentic identities.

Why it matters: It matters because IAM, PAM, and IGA teams need one operating model for users, service accounts, and AI agents if they want to reduce standing access and preserve auditability.

By the numbers:

• The 2024 Verizon Data Breach Investigations Report found that more than 74 percent of breaches involve identity-related factors.
• AI agents have already performed actions beyond their intended scope in 80 percent of organisations, according to SailPoint.
• Only 20 percent have formal processes for offboarding and revoking API keys, according to NHI Mgmt Group.

👉 Read Britive's analysis of continuous Zero Trust for human, NHI, and agentic access

Context

Zero Trust for identity is no longer just about getting the right person through the front door. The harder problem is what happens after authentication, when access must be constrained by task, context, and time across human, non-human, and agentic identities.

That gap is especially visible in environments where service accounts, API keys, and AI agents can retain access long after the work is done. In practice, the governance failure is standing privilege, not a lack of login controls, and that is exactly where IAM, PAM, and lifecycle governance now have to converge.

For identity programmes, the article is best read as a runtime control argument rather than a platform story. Its starting position is increasingly typical: enterprises have stronger entry controls than downstream privilege controls.

Key questions

Q: How should security teams implement just-in-time access for AI-related work?

A: Start by tying each privilege grant to a specific task, identity, and expiry condition. Use approval workflows for high-risk access, keep the default state non-persistent, and review whether the request can be satisfied through narrower data or tool permissions. The goal is to prevent standing access from becoming the normal way AI-enabled work is done.

Q: Why do standing credentials create outsized risk in cloud and SaaS environments?

A: Standing credentials turn a single successful compromise into reusable enterprise reach. They outlive the task that justified them, can be copied or chained into other systems, and often bypass the review cycles that were designed for slower, human-paced access governance.

Q: What breaks when AI agents are given standing privileges?

A: Auditability, containment, and accountability all degrade. A persistent agent can accumulate access beyond the task at hand, making it harder to prove why the access existed, who approved it, and when it should have ended. That creates the same governance drift seen in long-lived service accounts.

Q: Who is accountable when a non-human identity causes an access failure?

A: Accountability sits with the business owner, the identity governance process, and the system team that allowed the entitlement to persist. A non-human identity does not remove responsibility. If an access failure occurs, organisations need traceable approval, clear ownership, and a revocation path so the failure can be explained and corrected without ambiguity.

Technical breakdown

How runtime privilege control differs from authentication

Authentication answers who or what is entering, but runtime privilege control answers what that identity can do after entry and for how long. In this model, Duo handles assurance at the point of access, while Britive issues ephemeral credentials and revokes them when the task ends. That separation matters because the highest risk often emerges after a legitimate session begins, not during sign-in. For NHI and agentic systems, the control plane must therefore manage context, duration, and revocation as first-class policy inputs.

Practical implication: treat authentication and runtime authorisation as separate control layers, and verify that both are logged, enforced, and reviewable.

Why zero standing privilege matters for NHIs and agents

Zero Standing Privilege removes persistent access that can be reused, chained, or inherited across tasks. For service accounts, that means no long-lived tokens sitting in tooling or code. For AI agents, it means every tool call should be bounded by task scope and expiry, not by a broad pre-provisioned entitlement. The technical value is blast-radius reduction. If an identity is compromised or misused, the attacker or rogue process gets a narrow window and a narrow set of permissions instead of durable enterprise reach.

Practical implication: move high-value workloads off standing credentials and confirm that every privileged action is time-scoped and automatically revoked.

How policy enforcement works across SAML, OIDC, SCIM, and MCP

The architecture described in the article combines identity federation, synchronisation, and policy interception. SAML and OIDC establish trusted access paths, SCIM keeps identity attributes aligned, and MCP-style policy gates can intercept tool calls made by agents before those calls reach downstream systems. That pattern is important because it shifts control from static entitlement assignment to contextual authorisation at runtime. The same design logic applies to humans, workloads, and agentic systems, but the enforcement point has to match the identity subject and the action being taken.

Practical implication: map every privileged workflow to a policy enforcement point that can stop the action before downstream systems execute it.

Threat narrative

Attacker objective: The objective is to turn legitimate access into durable, reusable privilege that outlives the task and expands blast radius.

1. Entry begins with a legitimate authenticated session, where a human, workload, or AI agent is trusted to start work but not yet to hold broad privilege.
2. Escalation is avoided by issuing only task-scoped ephemeral credentials, because standing tokens would otherwise let the identity reuse access across multiple actions.
3. Impact is reduced because revocation occurs when the task ends, limiting persistence, lateral reach, and the chance of privilege reuse in later workflows.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero Trust has to move from entry control to runtime control. Authentication alone does not meaningfully contain modern identity risk when the same identity can hold privilege for the life of a workflow. The important change is not just where trust starts, but where it expires. For IAM and PAM teams, that means runtime authorisation is no longer optional plumbing, it is the control boundary.

Standing privilege is now the common failure mode across people, workloads, and AI agents. The article is strongest when it shows that the same governance weakness appears in human sessions, service accounts, and agentic workflows. Each actor type behaves differently, but the control failure is the same: access persists longer than the task that justified it. The implication is a unified privilege lifecycle model, not separate exceptions for each identity class.

Ephemeral credential trust debt: This article points to the hidden cost of relying on access that looks temporary but is governed like it is permanent. If the organisation cannot prove who received which privilege, for which task, and when it disappeared, it is carrying trust debt in every workflow. That is a governance problem before it is a technical one, and practitioners should treat it as such.

Agentic AI raises the standard for accountability, not just automation. Once an AI agent can act on behalf of users across cloud and SaaS systems, the identity model has to bind every action back to a sponsor, a task, and a revocation point. That is not the same as generic automation. Practitioners should read this as evidence that agentic access must be governed as an identity lifecycle, not as a convenience feature.

The market is converging on runtime identity enforcement as the next control plane. Products that only manage authentication or only manage secrets are increasingly insufficient on their own. The article reflects a broader shift toward policy interception, ephemeral credentials, and auditable enforcement across heterogeneous identity types. Security teams should expect procurement and architecture reviews to focus more heavily on runtime privilege than on static entitlement counts.

From our research:

• AI agents have already performed actions beyond their intended scope in 80 percent of organisations, according to AI Agents: The New Attack Surface report.
• Another finding from the same research shows that only 52% of companies can track and audit the data their AI agents access, leaving a 48% compliance and investigation blind spot.
• For a broader governance view, read Ultimate Guide to NHIs for the lifecycle controls that have to extend into agentic access.

What this signals

Ephemeral credential trust debt: Most organisations will not fail because they lack authentication. They will fail because they cannot prove that privileged access disappeared when the task ended. With 80% of organisations already seeing AI agents act beyond intended scope, the control question shifts from access approval to revocation certainty.

The practical programme response is to stop treating human, workload, and agent identities as separate governance universes. Continuous authorisation, lifecycle offboarding, and audit-grade event forwarding need to be designed together, otherwise every temporary grant becomes a durable risk story.

Teams that already use [the Ultimate Guide to NHIs](https://nhimg.org/the-ultimate-guide-to-non-human-identities) as a baseline should extend the same lifecycle logic to AI agents and tool-calling workflows before they scale further.

For practitioners

• Separate authentication from runtime authorisation Validate that identity assurance, privilege issuance, and revocation are handled by distinct control points. If a session can start securely but still inherit broad access, the programme has only solved the front door.
• Eliminate standing credentials for task-based workflows Replace durable API keys, long-lived tokens, and persistent role grants with task-scoped privilege and automatic expiry. Prioritise workloads that touch sensitive data, production systems, or downstream agent tool calls.
• Bind every agent action to an accountable human owner Register AI agents as distinct identities with an explicit sponsor, approved tool surface, and logged policy decisions. That creates traceability when the agent calls APIs, queries data, or delegates to other systems.
• Forward trust events into detection and audit workflows Send credential checkout, denial, and revocation events into the SOC data path so analysts can correlate identity behaviour with downstream system activity. Splunk or a similar SIEM should see the runtime story, not just login events.

Key takeaways

• The article shows that Zero Trust cannot stop at authentication when humans, service accounts, and AI agents can all carry privilege into the runtime phase.
• The evidence points to a structural governance problem, with standing access and incomplete auditability creating the real blast radius.
• Practitioners should focus on task-scoped privilege, automatic revocation, and accountable ownership before agentic access becomes the default operating model.

Key terms

• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.

What's in the full article

Britive's full blog covers the operational detail this post intentionally leaves for the source:

• Step-by-step architecture for Duo, Britive, and AgentCore integration across human, non-human, and agentic identities
• Runtime policy examples for just-in-time privilege across AWS, Azure, GCP, SaaS, Kubernetes, and on-prem systems
• Operational logging flow into Splunk for privilege grants, denials, and revocations
• MCP gateway enforcement details for agent tool calls and downstream access

👉 Britive's full post covers the Duo and AgentCore integration details behind ephemeral runtime enforcement

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.