Declarative governance for agentic systems: why IAM controls fall short

At a glance

What this is: This analysis argues that agentic systems need declarative, data-centric governance because IAM controls built for human users cannot keep pace with autonomous access and changing runtime behaviour.

Why it matters: IAM, IGA, PAM, and NHI teams need to govern what agents can access, how they use it, and when policy must trigger intervention, not just who received a role.

Context

Agentic systems are software entities that can access data, trigger actions, and operate across environments without direct human involvement. That changes the governance problem because classic IAM models assume stable roles, predictable access, and access decisions that do not change much once provisioned.

The article’s core point is that data-centric governance has to replace one-time approval logic with declared intent, continuous monitoring, and policy-based intervention. For NHI, autonomous, and human identity programmes alike, the issue is no longer only access assignment, but whether runtime behaviour stays within declared policy.

In practice, this is a governance gap, not just a visibility gap. If access is only reviewed at provisioning time, teams miss the fact that an agent can move, copy, or expose data long after the original approval made sense.

Key questions

Q: How should security teams govern agentic systems without relying on static IAM rules?

A: They should define acceptable behaviour up front, then validate runtime activity against that policy. The control focus shifts from one-time approval to continuous context, including data sensitivity, actor type, purpose, and actual use. That lets teams intervene when behaviour drifts outside policy instead of assuming the original grant still fits.

Q: Why do human IAM controls fall short for autonomous agents and service accounts?

A: Because human IAM assumes stable roles, predictable access patterns, and access decisions that stay meaningful after provisioning. Agentic and non-human actors can operate continuously, cross systems, and change how access is used, so the original role assignment tells you too little about runtime risk.

Q: What are the signs that delegated agent access is failing governance?

A: Common signs include missing provenance, broad permissions that outlast the task, and audit records that show what happened but not who effectively authorised it. If reviewers must reconstruct the originator, agent and target from separate logs, the governance model is already too weak for agentic workflows.

Q: When should organisations reduce or suspend an agent’s access?

A: Reduce or suspend access when the agent’s behavior no longer matches the approved task, when it reaches for credentials it should not need, or when its actions could widen blast radius. The right trigger is behavioral deviation, not only a failed login or a policy violation after the fact.

Technical breakdown

Why declarative governance replaces static permissioning

Declarative governance means defining acceptable behaviour in advance, then checking runtime activity against that policy. Instead of hard-coding permissions around a role or a one-time approval, the organisation declares what data is sensitive, which identities may access it, under what conditions, and what should happen when activity deviates. That matters because agentic systems do not behave like static applications. They can move across cloud, SaaS, file shares, and data platforms, making access scope and context more important than the initial grant. In identity terms, this is a shift from provisioning-centric control to behaviour-centric control.

Practical implication: Treat the policy definition as the control point, not the access grant.

Why identity-only controls miss agentic risk

Identity-only controls answer who has access, but they do not explain what the actor did with that access. For agentic systems and non-human identities, that distinction is critical because legitimate access can still create risk through volume, timing, or purpose drift. The article highlights a common failure mode: fragmented logs and entitlement views cannot reconstruct cross-platform behaviour well enough to judge whether the use was expected. Data classification and ownership provide the missing context, because the risk signal sits in how sensitive information is handled, not only in whether a token or account exists.

Practical implication: Correlate identity, entitlements, and data sensitivity before deciding whether activity is acceptable.

How continuous monitoring turns into policy enforcement

Continuous monitoring becomes useful only when it is tied to a declared policy threshold. In this model, data activity monitoring is not just forensic analysis after the fact. It is an operational signal that can trigger revocation, tighter access, quarantine, or guided remediation when usage falls outside policy. That is important in agentic environments because manual response is too slow for continuous operation. The governance model therefore links observability to intervention, using data context to decide whether to intervene proportionately rather than reactively. This is where declarative governance becomes enforceable instead of descriptive.

Practical implication: Connect activity monitoring to predefined remediation actions so policy violations do not wait for manual review.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Declarative governance is the right response when access behaviour is no longer stable enough for IAM to model upfront. Human-centric controls assume that roles, permissions, and usage patterns remain predictable long enough for access policy to hold its meaning. Agentic systems break that assumption because they operate continuously across multiple environments and can change how access is used after the grant. The practitioner implication is that governance must move from assignment-time certainty to runtime policy validation.

Data context is now the decisive control plane for agentic governance. When an agent can touch cloud data, SaaS content, and unstructured repositories, the useful question is no longer only who authenticated. The harder question is whether the data, purpose, and usage pattern match declared intent. That makes data discovery and classification foundational, because without them over-privilege and over-exposure cannot be judged consistently.

Identity-only observability is insufficient for non-human identity programmes. A service account or autonomous workflow may be fully authorised and still create unacceptable risk through volume, propagation, or cross-system movement. The failure mode is not merely missing visibility, but fragmented visibility that cannot join identity, entitlement, and data ownership into one policy view. The implication is that governance teams need contextual monitoring, not log accumulation.

Policy-driven intervention defines the difference between monitoring and governance. If unusual behaviour is only detected but not acted on consistently, the control is informational rather than governing. Declarative models work because they pre-authorise the response space, allowing teams to revoke, quarantine, or restrict when behaviour crosses declared boundaries. Practitioners should judge every governance control by whether it can drive a proportionate action at runtime.

Data-centric governance is becoming the practical bridge between human IAM, NHI oversight, and agentic AI control. The same lifecycle question now appears across all three actor types: what can access sensitive data, for how long, and under what behavioural conditions. That convergence means identity programmes cannot stay split by actor class. The practitioner conclusion is to design one governance model that can evaluate intent, context, and runtime behaviour together.

From our research library:

• Only about one-third of approximately 500 organizations surveyed by McKinsey in 2026 report maturity level three or higher across agentic AI governance controls.
• Read next: Agentic AI Identity Guide

What this signals

Declarative governance is becoming the only scalable answer to runtime identity drift in agentic environments. When an actor can continuously act across systems, static entitlements stop being a reliable indicator of safe behaviour. Teams should expect governance to move toward policy evaluation at the data layer, because that is where purpose and exposure can still be judged in context.

Data-centric control will increasingly define the boundary between acceptable automation and unmanaged exposure. As agentic adoption expands, the programme question is no longer whether access was approved, but whether current use still matches declared intent. That pushes IGA, NHI governance, and data security into one operating model rather than three separate ones.

For practitioners

• Define policy around data and behaviour, not just roles List sensitive datasets, allowed actor types, access conditions, and prohibited behaviour before agents are allowed into production workflows.
• Correlate identity with data context Join permissions, data classification, ownership, and actual usage so you can tell whether a non-human identity is acting within declared intent.
• Set intervention thresholds in advance Predefine when access should be tightened, revoked, or quarantined so policy violations can trigger action without waiting for manual triage.
• Review agent access as a runtime control Move reviews from one-time approvals to continuous validation of whether the agent’s current activity still matches the declared policy.
• Map sensitive data flows across environments Track how agent activity moves through cloud, SaaS, file shares, and data platforms so governance can see where exposure actually occurs.

Key takeaways

• Agentic systems expose a governance gap that human-centric IAM was not built to handle, because runtime behaviour matters as much as initial permissioning.
• The article’s central control shift is from static access grants to declarative policies tied to data sensitivity, actor type, and acceptable use.
• Practitioners need continuous validation and policy-driven intervention so that agent behaviour can be governed at the point of use, not after the fact.

Key terms

• Declarative Governance: A governance model that defines acceptable behaviour in advance instead of relying on one-time approvals or static permissions. In practice, it sets policy for data access, usage conditions, and remediation triggers, then evaluates runtime activity against those declared expectations.
• Data-Centric Governance: Data-centric governance is an operating model that places the data itself at the centre of security, access, and compliance decisions. Instead of relying only on network or platform boundaries, it ties control decisions to sensitivity, location, duplication, and the identities that can reach each dataset.
• Runtime Behaviour Monitoring: Runtime behaviour monitoring is the practice of watching what an identity actually does during execution, not just what it was configured to do. For AI agents, this means tracking tool calls, session activity, data volume, and unusual action sequences so semantic abuse can be detected in flight.
• Policy-Driven Intervention: An automated or guided response that is triggered when observed activity falls outside declared policy. In practice, this can mean tightening access, quarantining data, or forcing remediation so governance can act at runtime rather than only investigate after the fact.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.