Google’s agent vision exposes a 50:1 NHI security problem

At a glance

What this is: This analysis says Google's agentic AI vision is colliding with an already severe NHI governance problem: enterprises are scaling agents on top of an identity estate that is already overwhelmed.

Why it matters: It matters because IAM, PAM, and NHI programmes will inherit more credentials, more permissions, and more ownership ambiguity unless identity governance moves before agent adoption accelerates.

By the numbers:

• The report notes that 52% of executives already have agents in production.
• The enterprise ratio of non-human to human identities is already roughly 50 to 1.

Context

Google's agentic AI vision is a governance problem as much as a technology story. The article frames AI agents as a future operating model, but the security question is how identity, access, and credential control will cope when every employee can orchestrate multiple non-human identities.

In practical terms, each useful agent creates or consumes API keys, service accounts, OAuth tokens, and other secrets. That makes the primary issue NHI lifecycle management, not model capability, because the control plane has to keep pace with the identities that agents generate and depend on.

The article's starting position is typical of the current market: ambition is ahead of operational identity control. That gap is now common across cloud, SaaS, and CI/CD environments, so agentic AI simply intensifies an existing pattern rather than creating a wholly new one.

Key questions

Q: How should security teams govern AI agents that use multiple identity layers?

A: Security teams should inventory every identity layer an agent can use, including static credentials, session identities, embedded tool identities, and any delegated relationships between agents. Governance fails when one layer is controlled while another remains open, because the agent can still act through the weaker path. Treat the layered identity surface as the actual access boundary.

Q: Why do AI coding agents make credential sprawl worse?

A: They automatically inspect files, environment variables, APIs, and metadata to complete work, which lets secrets enter the agent's context without explicit user action. As more plugins and integrations are added, overlapping credentials multiply across systems, and teams lose visibility into what the agent can actually reach.

Q: What breaks when human-style access review is applied to agentic workflows?

A: The review cycle often arrives after the access has already been used and released. That leaves reviewers certifying a stale state, not the actual decision. The result is weak assurance, poor evidence quality, and a false sense of governance over machine-speed access.

Q: How can organisations prevent AI agents from becoming overprivileged?

A: Start with least privilege, then enforce it through narrow scopes, environment-specific approval, and regular access review. Separate human and agent access paths, prohibit shared credentials, and require every agent to have an owner. Overprivilege usually grows when teams treat agents like applications instead of identities.

Technical breakdown

Why agentic workflows multiply NHI credentials

Agentic workflows do not just add users. They introduce additional software entities that must authenticate to data sources, SaaS platforms, internal APIs, and orchestration layers. Each connection typically requires its own secret, token, certificate, or service account, which expands the number of identities and the number of trust relationships security teams must govern. The technical risk is not only quantity. It is that the access is often distributed across multiple tools and owners, making inventory, ownership, and revocation difficult to keep aligned with actual use. Practical implication: model each agent as a credential-bearing identity and track every dependent secret and permission as part of the same control scope.

Practical implication: Model each agent as a credential-bearing identity and track every dependent secret and permission as part of the same control scope.

How A2A and MCP change trust boundaries

Agent2Agent and Model Context Protocol are interoperability layers that let agents communicate across systems and retrieve grounded data from enterprise services. That is useful for automation, but it also creates new trust boundaries because one agent may act on behalf of another, or access systems that were not originally designed for agent-driven use. In identity terms, delegation becomes more dynamic, and accountability becomes harder to attribute when a chain of agents touches production data. Practical implication: map A2A and MCP integrations as explicit trust boundaries and require ownership, logging, and revocation paths for each boundary.

Practical implication: Map A2A and MCP integrations as explicit trust boundaries and require ownership, logging, and revocation paths for each boundary.

Why standing privilege is the wrong model for agents

Traditional IAM assumes access can be granted, observed, and then reviewed over time. Agentic systems break that assumption because useful agents often need broad, task-scoped access immediately and may create short-lived or nested credentials as they work. If those privileges are left standing, the access footprint grows faster than most teams can certify it. The result is not just overpermissioning. It is governance drift, where the identity estate becomes too dynamic for periodic review to catch up. Practical implication: move agent access decisions closer to issuance time and treat standing privilege as a design failure for agent workflows.

Practical implication: Move agent access decisions closer to issuance time and treat standing privilege as a design failure for agent workflows.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI turns NHI sprawl into an identity governance multiplier. The article is not really about a future of smarter workflows. It is about what happens when every workflow spawns more identities, more permissions, and more credential ownership problems than teams can inventory. The practitioner conclusion is simple: agent adoption cannot be separated from NHI lifecycle governance.

The 50:1 non-human-to-human identity ratio is the real baseline constraint. Google's agent vision lands on top of an estate where non-human identities already outnumber human identities by roughly 50 to 1. That means the next wave of agent adoption will not start from a clean slate; it will amplify existing inventory, ownership, and revocation deficits. The practitioner implication is that agent programmes inherit a governance debt that already exists.

Ephemeral agent access breaks the assumption that privilege can be reviewed after use. Access review processes were designed for access that persists long enough to be certified. That assumption fails when agents create, use, and discard credentials as part of runtime execution. The implication is that governance models must move from post-hoc review to issuance-time control for machine and agent identities.

Model Context Protocol creates a new form of connected-system trust debt. MCP makes it easier for agents to reach internal systems, but it also expands the number of systems that must trust the agent identity at runtime. The issue is not simply connectivity; it is whether each connection can be owned, monitored, and revoked with the same discipline as a privileged human session. Practitioners should treat MCP links as governed trust relationships, not plumbing.

Agentic AI security will be decided by credential lifecycle discipline, not by enthusiasm for automation. The report signals a market shift toward widespread agent use, but the organisations that succeed will be those that can keep track of ownership, scope, and decommissioning as identities proliferate. That means NHI governance, not model optimism, becomes the decisive control surface. Practitioners should align agent rollout with identity inventory, secret management, and offboarding controls.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Ephemeral access changes the governance target: access reviews are too slow for agentic systems if the credential exists only for the duration of a task. Security teams need to evaluate issuance-time controls, ownership tracking, and decommissioning logic instead of relying on periodic certification alone.

The article's broader signal is that agent adoption will widen the gap between identity inventory and identity governance unless programmes are redesigned around NHI lifecycle management. Clutch Security's framing is useful because it ties agent growth to the same operational problem security teams already face with service accounts, OAuth tokens, and API keys.

Use agentic AI identity and AI agent authorisation as the governance lens when planning new deployments, because agent capability without lifecycle control simply accelerates existing NHI risk. As the article implies, the hard part is not enabling the workflow; it is controlling who or what can act inside it.

For practitioners

• Map every agent to a governed identity Inventory each agent, the secrets it uses, and the human or team responsible for its lifecycle. Do not treat an agent as a feature flag; treat it as a credential-bearing identity with an owner, scope, and decommission path.
• Classify agent trust boundaries before rollout Document where Agent2Agent and MCP links cross team, vendor, and system boundaries. Require explicit approval for the data sources, APIs, and production systems each boundary can reach.
• Replace standing access with issuance-time controls Grant agent access only for the task being executed and expire it when the workflow ends. Standing privilege should be the exception, not the normal design pattern, for machine and agent identities.
• Track secret ownership through leaver changes Tie every agent credential to a clear owner and revoke or reassign it when the employee, team, or vendor relationship changes. Offboarding must cover both the agent identity and the credentials it depends on.

Key takeaways

• Google's agent vision matters to security teams because it multiplies non-human identities faster than most organisations can inventory, own, and retire them.
• The practical pressure point is not the model itself but the credential estate behind it, including API keys, service accounts, OAuth tokens, and other secrets.
• IAM and NHI programmes need to move from periodic review to lifecycle and issuance-time control if agentic workflows are going to scale safely.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
• Agent Trust Boundary Collapse: A failure mode where untrusted content, connected tools, and execution rights merge into a single decision path. Once that happens, prompt injection or malicious tool registration can produce real actions, turning the agent into a conduit for unauthorised system behaviour.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.