Intent-based access control for AI agents needs runtime governance

At a glance

What this is: This is ConductorOne's explanation of runtime governance for AI agent tool calls, showing how intent-based access control evaluates each call, applies policy, and records auditable decisions.

Why it matters: It matters because practitioners now have to govern agent actions at runtime, not just credentials and standing access, or they risk leaving a gap between what an agent may reach and what it can actually do.

👉 Read ConductorOne's post on agent runtime governance and tool-call controls

Context

Runtime governance for AI agents is the control layer that decides whether a tool call should run, be held for approval, or be blocked. In agentic systems, the security question is no longer only who has access, but whether each action is inside the agent's intended scope.

That distinction matters for AI agent identity governance because an agent can hold legitimate credentials and still be steered into harmful action through untrusted inputs. ConductorOne's framing is useful here because it shifts the control point from static entitlement to governed execution.

Key questions

Q: How should security teams govern AI agent tool calls without exposing credentials?

A: Security teams should place credentials in a separate execution layer, not in the model context, and bind every tool call to a distinct agent identity. The key controls are scoped consent, execution-time secret injection, and unified audit logging. That way the model can request actions without ever seeing the material that authorises them.

Q: Why do AI agents create governance problems that normal access reviews miss?

A: AI agents can read, copy, transform, and re-share data after the original access decision, so a static review of entitlements does not capture downstream impact. Governance has to measure what the agent actually did with the data, not only whether the agent was allowed to see it. That is why lineage and activity evidence matter.

Q: What breaks when an agent can reach private data and external channels at the same time?

A: The lethal trifecta creates a path from normal retrieval to exfiltration. If the agent can read sensitive records, process untrusted input, and send data outward, a hidden instruction can redirect a legitimate task into a breach. The failure is contextual control, because the same action looks harmless until all three conditions converge.

Q: Who is accountable when an AI agent makes a risky decision?

A: Accountability should rest with the organisation that authorised the agent, the human owner of the workflow, and the control process that allowed the behaviour. If an agent can act independently, the programme must preserve attribution, action logs, and policy decisions so audit and remediation are possible after the event.

Technical breakdown

How tool-call governance works at runtime

Runtime governance inserts a policy decision point between the agent and the tool. The agent does not call an API directly; instead, the call passes through a governed gateway that can classify the request, apply least-privilege tool scoping, and evaluate risk before execution. That makes the unit of control the action itself, not just the credential behind it. In practice, this is closer to identity-aware authorization than simple prompt filtering, because the policy is tied to the governed agent identity and its allowed toolset. The audit trail then captures what was attempted, what policy applied, and what happened next.

Practical implication: route agent tool calls through one enforcement layer and make the policy decision observable before execution.

Why the lethal trifecta changes agent risk

The lethal trifecta describes the point where private data, untrusted content, and an outbound path exist in the same session. That combination matters because a hidden instruction can turn a normal read operation into exfiltration without changing the underlying credential. The key risk is not that the agent can access data, but that it can be induced to use that access in the wrong context. Runtime scoring of those three conditions is therefore a contextual control, not a simple allow or deny list. It gives security teams a way to distinguish routine work from a high-risk chain of action.

Practical implication: classify agent sessions for the presence of all three conditions before allowing external-facing actions.

Intent-based access control depends on governed scope

Intent-based access control, as used here, is not a guess about what an AI model wants. It is governed scope, meaning the agent is limited to the tools and actions required for its job and every call is checked against policy. That is an important distinction because inferred intent is not a reliable security boundary, while scoped execution is. The model may reason in ways security teams cannot validate, but the toolset, owner, and policy decision are auditable. This makes the control closer to lifecycle-governed machine identity than to conversational safety tooling.

Practical implication: define agent permissions by task scope and review them as governed machine identities, not as generic chatbot privileges.

Threat narrative

Attacker objective: The attacker wants the agent to expose private records or other sensitive data outside the trusted environment without triggering a human review before execution.

1. Entry occurs when a hidden instruction is embedded in untrusted content that the AI agent processes during a normal support or workflow session.
2. Escalation happens when the agent has access to private data and an external communication path, allowing the instruction to convert routine retrieval into exfiltration.
3. Impact is the unauthorized transfer of sensitive records outside the environment, amplified by machine-speed execution and broad standing access.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime governance is now the missing layer between entitlement and execution. Traditional IAM and PAM tell you what an agent is allowed to hold, but they do not decide whether a specific tool call is safe in the moment. That gap matters because AI agents can convert legitimate access into harmful action without changing identity state. The implication is that agent governance has to be evaluated at the action boundary, not only at provisioning time.

The lethal trifecta is a named concept for a broader identity governance failure. Private data, untrusted content, and outbound communication are individually manageable, but together they create a runtime exfiltration path that static access reviews will not see. This is not just a prompt-injection problem, it is a scope-convergence problem in agent identity. Practitioners should treat any environment with all three conditions as an active governance exposure.

Intent-based access control only works when intent is translated into governed scope. If intent remains a model-level interpretation, the control is not verifiable enough for enterprise identity governance. A governed agent identity, an accountable owner, and auditable policy decisions make the access model reviewable; inferred intent does not. The implication is that AI agent control must be anchored in identity and lifecycle, not in model semantics.

Agent runtime governance should be understood as machine identity governance at the point of action. The important shift is from deciding who can authenticate to deciding what a non-human actor can do after authentication has already succeeded. That is where least privilege becomes operational rather than theoretical. Security teams should recognise this as a new enforcement surface, not a replacement for IAM, PAM, or secrets governance.

Named concept: runtime exfiltration window. The article shows how the period between a tool call being requested and the result leaving the environment is the critical governance window for AI agents. That window is where policy, approval, and redaction must operate. Practitioners should treat that interval as the new blast-radius boundary for agentic systems.

From our research:

• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which shows how often machine identity programmes still lack basic inventory control.
• If you are mapping these gaps to a programme plan, Ultimate Guide to NHIs - Lifecycle Processes for Managing NHIs is the natural next step for lifecycle, rotation, and offboarding detail.

What this signals

Runtime exfiltration window: the security boundary for agentic systems is shifting from credential issuance to the moment a tool result leaves the environment. Teams that still treat agent access as a provisioning problem will miss the part of the lifecycle where abuse actually occurs.

With 92% of organisations exposing NHIs to third parties, per the Ultimate Guide to NHIs, the broader lesson is that external connectivity has become a governance multiplier, not just an integration convenience.

Practitioners should expect runtime policy, approval routing, and auditable owner mapping to become baseline requirements for agent programmes, especially where tools can touch private data and external systems.

For practitioners

• Route every agent tool call through a single enforcement point Centralise decisioning so the call is classified before execution, policy is applied consistently, and every outcome is tied to the governed agent identity and owner.
• Scope agent toolsets to the minimum job-required actions Give support agents only support tools, data agents only read and query tools, and keep destructive actions outside the default toolset unless there is a specific governed need.
• Use observe mode before enforcing runtime policies Start with projected decisions, review where policies would block, hold, or redact, then tune the policy and move to enforcement once the impact is understood.
• Tie approvals to the specific risky action, not the whole session Require human review only for the call that crosses the risk threshold, so approval controls remain proportional and do not force blanket friction across low-risk actions.

Key takeaways

• AI agents need runtime governance because legitimate access can still be turned into harmful action inside a live session.
• The lethal trifecta of private data, untrusted content, and outbound communication is the clearest signal that agent controls are too static.
• Identity teams should move from reviewing entitlements to governing each tool call, because that is where agent risk becomes real.

Key terms

• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Lethal Trifecta: A risky AI agent condition where one system can read private data, consume untrusted content, and communicate externally. When those three capabilities overlap, the agent can be tricked into disclosing sensitive information through legitimate tools without a conventional exploit.
• Intent-Based Access Control: An access control model that evaluates not just what an agent is requesting, but the inferred intent and context behind the request — granting or denying access based on whether the action aligns with the agent's declared purpose.
• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.

What's in the full article

ConductorOne's full blog covers the operational detail this post intentionally leaves for the source:

• How observe mode projects block, hold, and redact outcomes before enforcement
• The policy logic used to score the lethal trifecta across live agent sessions
• How the governed AI gateway classifies MCP servers and internal tools
• The audit record structure that ties each decision to an agent identity and owner

👉 The full ConductorOne post covers policy scoring, observe mode, and the governed gateway design.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.