Identity was built for humans: agentic AI changes the trust model

At a glance

What this is: This is an analysis of how agentic AI breaks human-centred identity assumptions and why non-human identities become the control plane for autonomous systems.

Why it matters: It matters because IAM, PAM, and NHI teams need controls that authorize actions in real time, not just identities at login, especially when agents, workloads, and service accounts outnumber humans and behave differently.

By the numbers:

• Non-human identities outnumber human users by roughly 45 to 1 in the modern enterprise, and as much as 100 to 1 in some organizations, according to Rubrik Zero Labs.
• 47% of non-human identities are more than a year old with no credential rotation, according to Rubrik Zero Labs.

👉 Read Pomerium's analysis of how agentic AI changes identity trust

Context

Identity systems were designed around a human on the other end of the request. That assumption breaks when an AI agent acts continuously, at machine speed, and can chain tool calls without a person present to validate each step. The result is not just more automation, but a different access model that traditional IAM, PAM, and NHI governance must account for.

For practitioners, the key issue is that agentic AI turns identity into the control plane for autonomous execution. That means authorization has to move closer to the action itself, because a login event or a long-lived token no longer tells you enough about what the system should be allowed to do right now. Pomerium frames the problem correctly: the boundary is intent, not network location.

The same pressure shows up in NHI programmes already struggling with visibility, rotation, and offboarding. NHIs, service accounts, ephemeral functions, and agent credentials all sit inside the same governance problem space, but agentic systems make the timing and scope of access less predictable than conventional machine identities.

Key questions

Q: How should security teams govern agentic AI that can execute IAM tasks?

A: Start by treating the agent as an NHI with bounded authority, explicit ownership, and revocation procedures. Require human approval for high-risk actions, log every decision path, and enforce least privilege at the workflow level. If the agent cannot be audited or rolled back, it is not yet ready for autonomous IAM execution.

Q: Why do traditional IAM controls struggle with autonomous AI agents?

A: Traditional IAM assumes predictable users or static machine accounts, but AI agents can act independently, interact with multiple systems, and generate new access needs over time. That makes static role assignment and one-time approval insufficient. Security teams need continuous evaluation, not just initial authentication and authorization.

Q: What do security teams get wrong about prompt injection defence?

A: They often assume better blocklists will solve the problem, but obfuscation simply changes the shape of the payload. Real defence requires examining meaning across the full interaction, including retrieved content and model responses. If the control cannot interpret intent, it will keep missing the attack class it is meant to stop.

Q: Who is accountable when an AI agent takes an unsafe action?

A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.

Technical breakdown

Why static scopes fail for agentic AI

Static scopes assume the job is known in advance and the actor will keep doing the same thing for the duration of the session. Agentic systems do not behave that way. They infer intent from prompts, decompose tasks into multiple API calls, and may discover new tools mid-session, which means the effective blast radius can expand after authorization has already been granted. That makes traditional least-privilege design incomplete when the actor can change its own execution path.

Practical implication: move from session-level permissioning to action-level authorization with policy evaluated at request time.

Per-request authorization in Zero Trust for NHIs and agents

Zero Trust works better for machines than for people because machine requests are easier to evaluate continuously. The design pattern is straightforward: verify identity, context, and purpose on each request, not just at connection time. For autonomous systems, that means the policy engine must sit in the data path and decide whether the action is appropriate right now. If the control plane only authenticates once, it cannot contain later tool misuse or scope drift.

Practical implication: place an enforcement point where requests can be denied in flight and every decision is logged.

Why prompt injection becomes an access-control issue

Prompt injection is often discussed as a model-safety problem, but the identity consequence is more concrete. If an attacker can influence what an agent decides to do, and the agent holds broadly scoped credentials, then the attacker inherits those credentials in practice. The important failure is not that the model was tricked, but that the authorization boundary trusted the model’s output path too much. In MCP-driven environments, the security model depends on how tools and tokens are brokered, not on the prompt alone.

Practical implication: separate model input from authorization decisions and ensure agents never handle durable bearer tokens.

Threat narrative

Attacker objective: The attacker wants to turn compromised NHI or agent credentials into reusable access that can be chained across systems without human approval.

1. Entry occurs when attackers target exposed non-human credentials, because the first step is often stealing or finding a usable token rather than breaking a password prompt.
2. Escalation occurs when broadly scoped agent or workload credentials allow tool calls, API access, or chained actions beyond the original request boundary.
3. Impact occurs when the attacker uses that standing access to move through connected systems, exfiltrate data, or trigger unauthorized autonomous actions at machine speed.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI does not just increase NHI volume, it breaks the assumption that access can be defined before execution begins. Traditional IAM and NHI models assume a stable actor, a known purpose, and a bounded session. Agentic systems can re-plan, re-select tools, and extend their own execution path mid-session, so provisioning-time least privilege is no longer sufficient as a governance premise.

Intent-based authorization is becoming the real control boundary for autonomous systems. When an agent can act continuously, the question is no longer who authenticated, but whether this specific action should be allowed right now. That shifts the centre of gravity from identity proofing to live decisioning, which is why identity-aware proxies and inline policy enforcement matter more than static entitlements.

Human attribution must survive the delegation chain. In agentic workflows, accountability collapses if logs only show a service account or an MCP server identity. The programme requirement is not just traceability, but preserved human principal linkage across every hop, because governance, incident response, and audit all depend on knowing which person initiated the autonomous action.

Long-lived tokens are the structural accelerant behind both NHI sprawl and agentic misuse. The same credentials that made machine identity convenient also make autonomous access difficult to bound. Once durable secrets are available to an agent, prompt injection, tool misuse, and lateral movement become variations of the same access problem, not separate security silos.

Identity governance for agents must be designed as runtime control, not retrospective review. Access reviews, recertification, and offboarding still matter, but they are too slow to be the primary defence for systems that can act, chain decisions, and terminate tasks before a review cycle begins. Practitioners need to treat runtime authorization as the authoritative layer and lifecycle governance as supporting evidence.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage, according to NHI Mgmt Group research.
• For a broader breach lens, see 52 NHI Breaches Analysis, which shows how credential exposure and weak lifecycle controls repeatedly turn into real incidents.

What this signals

Agentic AI will force IAM teams to stop treating authentication as the control boundary. When the actor can decide, chain, and execute independently, the meaningful decision happens at request time, not sign-in time. That shifts programme priorities toward inline enforcement, human attribution, and short-lived credential brokering rather than broader session trust.

Runtime governance will become the differentiator between visible and governable machine access. The organisations that can explain what an agent was allowed to do, why it was denied, and which human it acted for will have materially stronger control over autonomous workflows. Those that rely on access review cadence alone will keep discovering problems after the fact.

Identity blast radius is now a planning term, not just a post-incident metric. As non-human and agentic identities multiply, the question is no longer whether you have enough controls on paper, but whether the control path can keep pace with machine-speed decisions. That is where Zero Trust, NHI governance, and AI risk management now meet.

For practitioners

• Inventory every non-human credential in the agentic path Build a complete list of tokens, service accounts, API keys, certificates, and agent credentials, including age, owner, scope, and last rotation date. If you cannot name the credential and its lifecycle state, you do not understand the attack surface.
• Remove durable bearer tokens from agent workflows Broker credentials through short-lived scoped assertions rather than giving agents long-lived secrets they can reuse or leak. This reduces the chance that one compromised agent session becomes broad reusable access.
• Enforce policy at request time in the data path Put a decision point between the agent and the target system so each tool call can be allowed or denied against live context. Logging must be generated by the same component that makes the decision, not reconstructed later from scattered telemetry.
• Preserve human attribution through every delegation hop Make it possible to answer which person initiated the action even when the execution path passes through agents, service accounts, and MCP tools. Audit records should name the human principal, not just the runtime identity.
• Pilot one constrained agent with deny-log review Start with a single internal MCP server, one agent, and one policy that meaningfully restricts tool use. Review deny logs for a week to identify where intent, scope, and access are misaligned before scaling the pattern.

Key takeaways

• Agentic AI breaks the assumption that identity can be governed entirely at login or provisioning time.
• The same NHI visibility and secret hygiene gaps that already affect enterprises become more dangerous when credentials can drive autonomous tool use.
• Practitioners should move authority into the request path, preserve human attribution, and reduce durable secrets wherever agents operate.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Identity-aware Proxy: An identity-aware proxy combines routing with authentication and authorization logic. It checks tokens or certificates, applies policy at the edge, and forwards verified identity context to the backend so applications do not have to re-implement security decisions inconsistently.
• Human attribution: The ability to trace an action performed by a machine or agent back to the person or process that initiated it. This matters because agentic workflows can obscure accountability if logs only show the runtime identity instead of the underlying human principal.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Pomerium's full blog post covers the operational detail this post intentionally leaves for the source:

• How its identity-aware proxy enforces per-request policy for agents, engineers, and CI pipelines.
• How it brokers external identity tokens into short-lived scoped JWTs without token passthrough.
• How MCP tool restrictions can be applied at the action layer instead of in each server.
• How deployment works across Kubernetes, cloud, and on-prem environments with gRPC and WebSocket traffic.

👉 The full Pomerium post covers the control path, MCP policy handling, and deployment model in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.