Ephemeral certification and AI agents are reshaping privileged access

At a glance

What this is: This is a privileged access analysis arguing that ephemeral certification and context-aware authorisation are becoming necessary as AI agents and machine identities expand access paths.

Why it matters: It matters because IAM, PAM, and NHI teams need to govern what identities can do in runtime, not just who owns the account or whether a credential exists.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.

👉 Read SSH Communications Security's analysis of ephemeral certification and AI agent privileged access

Context

Privileged access is shifting from a human-admin problem to a mixed identity problem. AI agents, workloads, and service identities now initiate access to systems, data, and APIs, which means security teams must govern actions as well as accounts. In practice, that turns ephemeral certification, short-lived authentication, and contextual authorisation into core identity controls rather than niche techniques.

The primary gap is that standing privilege and reusable secrets assume access is stable enough to manage manually. That assumption weakens when an identity can choose tools, chain tasks, or request access dynamically during execution. For IAM and PAM teams, the question is no longer whether access exists, but whether the access model can bound what an identity may do at runtime.

This article is best read as a governance argument rather than a product feature note. The starting position, that access control should follow action scope and time scope, is now typical across modern NHI and AI-enabled environments.

Key questions

Q: How can teams govern machine identities and AI agents in access reviews?

A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers. If a non-human identity can act on sensitive data, it needs a lifecycle owner and a removal path just like any other privileged account.

Q: Why do AI agents create more risk than traditional automation?

A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously. Traditional automation follows fixed rules, but an agent can be manipulated into using its own authority in unintended ways. That makes permission scope, tool boundaries, and monitoring more important than model accuracy alone.

Q: What breaks when privileged access still depends on long-lived secrets?

A: Long-lived secrets create standing privilege, which means compromise windows stay open long enough for attackers to harvest, reuse, and spread access. They also make lifecycle governance weaker because revocation becomes manual and delayed. In cloud-native environments, that breaks the assumption that access can be safely left in place between tasks.

Q: What should organisations check before rolling out zero standing privilege at scale?

A: They should check whether approvals, expiry rules, and review workflows can all operate on the same task boundary. If the tooling cannot express task completion cleanly, the programme will fall back to manual workarounds and broader permissions. Zero standing privilege scales only when the policy model is precise enough to remove access automatically.

Technical breakdown

Ephemeral certificates and short-lived access decisions

Ephemeral certification means issuing a certificate for a specific access need and letting it expire automatically once that need ends. The mechanism reduces credential reuse because there is no durable password, SSH key, or long-lived certificate left in circulation. The control value comes from time limitation plus scope limitation: the certificate should be valid only for the resource, action, and context that were approved. In identity terms, this converts access from a persistent entitlement into a bounded runtime event. That matters because compromise windows shrink, revocation becomes less dependent on manual cleanup, and audit trails become easier to interpret when every credential has a narrow purpose.

Practical implication: replace persistent machine secrets with short-lived credentials where runtime access can be scoped to a single task or session.

Why AI agent access is different from script-based automation

A traditional script follows a fixed path, but an AI agent may decide what to do next, which tool to use, and whether to continue by creating subagents or chaining actions. That behaviour changes the identity problem. Static approval models and broad role assignments become harder to defend because the actual access path is not fully known at provisioning time. The issue is not simply that agents are automated. It is that they can make runtime choices that expand their own effective privilege footprint unless the authorisation layer constrains each step. In NHI terms, the controlling question becomes whether the identity can only act within a pre-approved action envelope.

Practical implication: bind agent permissions to narrowly defined tools, resources, and execution scopes instead of assigning broad reusable roles.

Context-aware authorisation for privileged actions

Context-aware authorisation asks who or what is requesting access, what resource is needed, which action is allowed, and whether the request fits policy at the moment it is made. That is different from simply authenticating an identity once and assuming the resulting session should remain trusted. Zero Trust and zero standing privilege both depend on this distinction. They do not eliminate access, but they force access to be evaluated continuously against context. For NHI and AI agent environments, this is where governance shifts from account management to action governance. Without that shift, the organisation can authenticate an identity but still fail to control what it does next.

Practical implication: attach policy checks, audit logging, and least-privilege constraints to each action decision, not just the initial login.

Threat narrative

Attacker objective: The attacker wants durable access paths that can survive normal account review cycles and enable repeated abuse of systems, data, or tools.

1. Entry occurs when an attacker or malicious actor gains access to a reusable machine secret, static key, or long-lived certificate.
2. Escalation follows when that credential is used to reach APIs, data stores, or administrative functions beyond the original intended scope.
3. Impact appears as broader compromise, because the standing credential can be reused, chained, or exfiltrated before the organisation detects the misuse.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privilege is becoming an action problem, not just an account problem. The article is right to shift the centre of gravity from privileged users to privileged actions. That matters because AI agents and workloads are often the systems actually making access decisions at runtime, while human governance still assumes a named administrator behind every sensitive action. The implication is that PAM and IAM teams need to measure what an identity can do in the moment, not only what role it was assigned at birth.

Short-lived credentials reduce exposure, but they do not solve authorisation design. Ephemeral certificates shrink reuse windows, which is useful, but the real governance boundary is still the policy that decides what each request may reach. A certificate that expires quickly can still authorise the wrong action if context is too broad or if the tool path is over-entitled. The practitioner conclusion is that lifetime control and action control must be designed together.

Static privilege assumptions do not survive agentic behaviour. Least privilege was designed for identities whose access requirements are reasonably knowable before execution begins. That assumption fails when an AI agent can choose tools dynamically, chain actions, or create subagents during the task. The implication is that identity governance must stop treating privilege as a provisioning-time snapshot and start treating it as a runtime constraint.

Ephemeral credential trust debt: many programmes will adopt short-lived secrets but keep the same broad authorisation model underneath. That creates a new form of trust debt, where the credential is temporary but the reachable blast radius is still too large. The practitioner conclusion is that ephemeral access only becomes meaningful when the reachable action set is also reduced.

Zero standing privilege is becoming the right baseline for mixed human, NHI, and AI environments. The article aligns with the direction the market is already moving in: access should be granted only when needed, for only the needed action, and only for the needed duration. That does not remove governance complexity, but it makes hidden entitlement accumulation much harder to justify. The field should expect action-scoped access models to replace account-scoped thinking in more programmes.

From our research:

• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
• From our research: 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• From our research: Use Ultimate Guide to NHIs , 2025 Outlook and Predictions to compare short-lived access strategy with broader lifecycle governance.

What this signals

Ephemeral certification will not be adopted evenly across the stack. Most programmes will start with the highest-risk machine access paths, then discover that the limiting factor is policy design rather than credential format. The governance task is to shrink action scope at the same time as credential lifetime, otherwise temporary secrets simply mask a larger entitlement problem.

Action governance is the next control layer for mixed identity environments. Once AI agents and workloads can initiate access dynamically, account-centric review processes stop giving a complete picture. Teams should prepare for more runtime policy enforcement, more granular audit evidence, and tighter linkage between identity systems and privileged toolchains.

Zero standing privilege becomes more credible when paired with lifecycle discipline. If machine identities are already outnumbering human identities, as SSH Communications Security notes, then the operational burden will move toward automated issuance, expiration, and revocation. The organisations that can make those cycles observable will have a clearer path to governing both NHI and agentic access.

For practitioners

• Define action-scoped access use cases Map each privileged task to the exact resource, action, and duration required. Use that mapping to decide where a short-lived certificate is appropriate and where a standing entitlement is no longer defensible.
• Constrain AI agents to pre-approved execution envelopes Limit agent access to named tools and named data domains, and require policy evaluation for each step that could expand scope. Do not treat an agent as safe simply because it authenticates successfully.
• Replace reusable secrets with ephemeral credentials Prioritise workloads, service accounts, and AI integrations that still rely on passwords, SSH keys, or long-lived certificates. Remove durable secrets first where revocation and reuse would create the largest blast radius.
• Add action-level audit trails Log the request context, approved resource, granted action, and expiry condition for each sensitive access decision. That gives IAM and PAM teams evidence for review when access is generated dynamically by machines or agents.

Key takeaways

• Privileged access is no longer just about users, because machine identities and AI agents now create the access decisions that matter most.
• Short-lived certificates reduce credential reuse, but they only work when action scope and policy scope are narrowed at the same time.
• Programmes that move toward zero standing privilege will need runtime authorisation, stronger audit trails, and better NHI visibility to make the model hold.

Key terms

• Ephemeral certificate: A short-lived digital credential issued for a current session rather than stored for long-term reuse. In connected OT environments, ephemeral certificates reduce the value of stolen credentials and provide a cleaner control point for remote authentication and revocation.
• Privileged Action: A privileged action is a sensitive operation that can change data, configuration, access, or control inside an environment. In modern PAM, the action matters more than the account label because the same identity may be harmless in one context and high risk in another.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Context-Aware Authorization: Context-aware authorization evaluates signals such as device posture, time, resource sensitivity, and request type before allowing access. It moves IAM away from static permission checks and toward decisions that reflect current risk, which is essential in cloud-native environments with frequent identity changes.

What's in the full article

SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:

• How ephemeral certificates are issued and expired in practice across privileged workflows
• The webinar discussion of privileged actions versus privileged users in AI-enabled environments
• The policy context for context-aware access decisions involving machines, workloads, and AI agents
• The practical framing of zero trust, least privilege, and zero standing privilege in mixed identity environments

👉 SSH Communications Security's full article covers the webinar framing, runtime access model, and contextual controls in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.