Identity was built for humans: agentic AI changes the trust model

At a glance

What this is: Agentic AI turns identity from a human login problem into a continuous machine-access problem, and the article says static scopes, long-lived credentials, and session controls no longer fit that model.

Why it matters: IAM, PAM, and NHI teams have to treat every agent credential as a live attack path, because authorization now has to follow action, context, and attribution instead of a person at login time.

By the numbers:

• Non-human identities outnumber human users by roughly 45 to 1 in the modern enterprise.
• Non-human identities can outnumber human users by as much as 100 to 1 in some organisations.
• 47% of non-human identities are more than a year old with no credential rotation.
• Identity-based attacks account for 30% of intrusions, tied with public-facing application exploits as a leading access vector.

Context

Identity systems were built around a human at the other end of the request. That assumption shaped login, session, consent, and escalation models, but agentic AI removes the person from the loop and replaces them with a credential holder that acts continuously.

For IAM and NHI programmes, the real issue is not that more systems are automated. It is that the trust model now has to govern runtime decisions made by non-human actors whose next action is not fixed at provisioning time. That changes where authorization must happen and what needs to be audited.

The article frames this as a zero trust problem for autonomous systems, not a model-safety problem. That is the right lens for practitioners, because the control boundary has shifted from identity proofing to live enforcement on every request.

Key questions

Q: What breaks when agentic AI inherits human-era identity controls?

A: Static scopes, session-based controls, and login-time approval all assume a person is present and intent stays stable. Agentic systems can select tools, chain calls, and change effective scope at runtime, so those controls no longer define real access. The practical failure is that authorization becomes detached from action, which leaves broad credentials usable far beyond the original request.

Q: Why do long-lived credentials create a bigger risk for AI agents than for traditional automation?

A: AI agents can choose tools and sequence actions dynamically, so long-lived credentials become durable authority across many unpredictable requests. That makes it harder to prove least privilege, track accountability, or limit blast radius. Traditional automation is usually fixed and bounded, while an agent can reuse the same secret in ways the original design did not anticipate.

Q: How can security teams tell whether action-time authorization is actually working?

A: Look for a clear separation between attempted and executed actions. A working control should show blocked calls for risky operations, consistent policy decisions across tools, and approval records where human review is required. If blocked attempts are invisible or execution logs show unauthorised side effects, the control is not effective.

Q: What should teams do when an agent acts on behalf of a human principal?

A: They should preserve attribution from the initiating person through every hop, tool call, and backend service so the action can be traced end to end. The agent should not become a separate standing identity with its own entitlements. That keeps accountability intact while still allowing the workflow to run under live policy.

Technical breakdown

Why static scopes fail for agentic AI credentials

Static scopes assume a workload has a stable job description and a predictable action set. Agentic AI breaks that assumption because the system decomposes intent at runtime, selects tools dynamically, and may chain calls in ways that were not explicit at provisioning time. That means the effective blast radius changes with context, prompt content, and available integrations. In NHI terms, the credential is no longer attached to one fixed workflow; it becomes a permission envelope around a decision-making loop. The article is right to treat prompt injection as an access-control issue, because attacker influence over action selection becomes privilege use, not just model misbehaviour.

Practical implication: Treat scope as a live enforcement problem, not a provisioning-time property.

Why per-action authorization matters more than session control

Traditional authentication answers who arrived and whether the session was established. It does not answer whether the 400th tool call in that session is appropriate. For agentic systems, authorization has to evaluate the request itself using live context such as identity, time, origin, requested resource, and action type. That is the control shift the article describes when it argues that policy belongs in the data path. Without per-action checks, a single broadly scoped token can be reused across a long-running autonomous session in ways no session-level gate can meaningfully constrain.

Practical implication: Evaluate each agent action against current policy instead of relying on session entry checks.

How token passthrough increases NHI blast radius

Token passthrough preserves bearer credentials end to end, which is convenient for integration but dangerous for autonomous use cases. If the agent or intermediary layer can see a durable token, then compromise, leakage, or misuse expands beyond the original request boundary. The article’s emphasis on short-lived scoped JWTs and signed identity assertions reflects a broader NHI pattern: the backend should trust the enforcement layer, not the raw credential. That reduces standing exposure and makes attribution possible when an agent acts on behalf of a human principal.

Practical implication: Remove raw bearer tokens from agent paths and broker identity through short-lived assertions.

Threat narrative

Attacker objective: The attacker wants to turn agent-driven autonomy into unauthorized access and downstream system manipulation under legitimate-looking identity context.

1. Entry occurs when an attacker influences an agent through prompt injection or another untrusted input channel while the agent holds a broadly scoped credential.
2. Credential abuse follows when the agent’s token can be used to invoke tools or systems beyond the user’s intended request, turning the token into an access path.
3. Escalation happens as the agent chains calls across systems and the effective blast radius expands with each discovered tool, integration, or inherited permission.
4. Impact is unauthorized access, data exposure, or destructive action executed under apparently legitimate identity attribution.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI creates an assumption collapse in identity governance: least privilege was designed for actors whose intent is knowable at provisioning time. That assumption fails when the actor decomposes intent at runtime and selects actions dynamically from a tool set. The implication is not simply tighter access control, but a rethink of where privilege is even definable for autonomous systems.

Identity blast radius becomes the right control concept: the article shows that the risk is not the credential itself, but how far that credential can travel through chained actions, inherited tools, and long-lived sessions. In NHI governance terms, every new integration can widen the practical scope of a single identity far beyond its declared role. Practitioners should judge controls by how much blast radius they actually contain.

Long-lived credentials are now a structural liability for autonomous systems: Rubrik Zero Labs’ figures on stale NHI credentials and enterprise NHI density reinforce that the problem is not hypothetical. When machine identities already outnumber humans at high ratios, agentic AI simply magnifies an existing governance deficit. The lesson for NHI and IAM teams is that lifecycle discipline has to move from periodic review to runtime containment.

Attribution has to survive the delegation chain: the article correctly argues that an agent should not become a new identity island with its own standing entitlements. A human principal may start the action, but the system still needs durable attribution across hops, tools, and backend services. Without that, auditability fails even when access is technically constrained.

Zero trust for autonomous systems is a control-plane problem, not a model problem: the decisive boundary is the action path, not the model output. That means governance frameworks built around prompts, approvals, or static entitlements miss the real point of failure. Practitioners should treat the control point itself as part of the identity architecture, not as an add-on.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Ephemeral credential trust debt: agentic systems inherit all the weaknesses of long-lived machine access, but they also accelerate the time between issuance and misuse. When credentials can be discovered, chained, and reused at machine speed, periodic review becomes too slow to protect the boundary.

The next governance shift is from access review to issuance control. Access reviews assume a privilege persists long enough to be certified; autonomous workflows can consume and discard privileges before a reviewer ever sees them, so enforcement has to happen before the token is issued.

For practitioners

• Inventory every agent credential Build a complete inventory of tokens, service accounts, and ephemeral credentials used by agents, then record last-rotated dates and owning principals. If you cannot enumerate them, you cannot govern the attack surface created by autonomous access.
• Move authorization into the data path Enforce allow or deny decisions on each request using live context such as identity, resource, action type, and request origin. Do not rely on login-time checks or session entry decisions to control long-running agent behaviour.
• Broker agent credentials with short-lived assertions Replace durable bearer tokens with short-lived scoped assertions signed by an enforcement layer, so backend services never receive raw OAuth tokens or reusable secrets from agents.
• Require human attribution through every hop Make the audit trail answer which person the agent acted for, which tool it invoked, and which backend action was allowed or denied. Preserve attribution across proxy, tool, and service boundaries.
• Test one high-value agent path under deny conditions Pilot a single agent, one internal tool chain, and one policy that meaningfully restricts action. Review deny logs to see which requests would have expanded scope or exposed data.

Key takeaways

• Agentic AI invalidates identity assumptions built around a human user sitting behind each request, which makes static scopes and session controls unreliable.
• The article ties this shift to concrete risk signals, including the 45 to 1 NHI ratio and 47% of NHIs older than a year without rotation.
• Practitioners need per-action authorization, short-lived credentials, and attribution that survives every hop in the delegation chain.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Short-Lived Scoped Credential: A credential issued for a narrow task and a limited time window. For autonomous workflows, the value is not just expiration, but that the credential can be brokered and constrained so the agent never holds a durable bearer token.
• Attribution Chain: The sequence that links an action back to the human principal, policy decision, proxy, and backend service that allowed it. In autonomous environments, preserving the attribution chain is essential for auditability, incident response, and governance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.