Palo Alto Networks acquires Portkey for AI agent governance

At a glance

What this is: This is a news analysis of Palo Alto Networks’ acquisition of Portkey, centred on what unified AI gateway governance changes for autonomous agent control.

Why it matters: It matters because IAM, PAM, and NHI teams now need to think about agent runtime access, tool use, and delegated privilege as a governed lifecycle, not a one-off policy decision.

Context

AI agent governance is the set of controls that decides what an autonomous system can reach, which tools it can use, and how its privilege changes during runtime. In this article, that problem is no longer theoretical because the acquisition is framed around a unified control plane for agents rather than a narrow point product.

For IAM and NHI programmes, the real issue is that agent behaviour can shift after authorisation begins. Existing access models assume a mostly stable identity with reviewable entitlement, but agentic workflows can combine delegated access, tool calls, and re-authentication in ways traditional governance was not built to observe in real time.

That makes the topic relevant to identity architecture, not just AI security. The article is about what happens when agent governance becomes part of the access plane itself, which is why the implications extend across NHI governance, PAM, and emerging AI agent identity practices.

Key questions

Q: What should teams do when AI agent tool access changes mid-session?

A: Teams should treat mid-session tool changes as an access event, not a routine operational detail. The access state should be re-evaluated immediately, and any correlated runtime behaviour should be reassessed before the agent continues. Otherwise, the system may continue acting under an outdated understanding of privilege.

Q: Why does autonomous agent governance increase security risk when privilege looks limited at onboarding?

A: Onboarding scope can look narrow while the agent’s live behaviour is still capable of expanding into more systems, tools, and data paths. That creates a false sense of containment. Risk rises because the meaningful boundary is not the initial grant, but how far the delegated identity can travel once execution starts.

Q: What breaks when AI agent access is reviewed only after the fact?

A: After-the-fact review leaves a gap between action and containment. If an agent can already reach a dataset, API, or SaaS system, the damage may be done before a human sees the alert. Runtime checks reduce that gap by stopping unauthorized actions before they execute.

Q: What is the difference between AI agent authorization and standard application access control?

A: Standard application access control usually governs a known workflow with bounded permissions. AI agent authorization has to govern a system that may choose tools dynamically, chain actions, and continue without a human approval gate on each step, so runtime scope control becomes part of the control itself.

How it works in practice

Why unified AI gateways matter for agent authorization

A unified AI gateway sits between the agent and the tools, data, or APIs it may call, so the gateway becomes the enforcement point for identity, policy, and routing decisions. For autonomous agents, that matters because the runtime path is not fixed in advance the way a service account flow usually is. The control problem is not simply whether the agent has access, but whether the platform can evaluate each action against current scope, context, and trust. When the gateway is the decision point, governance moves from static provisioning to runtime mediation.

Practical implication: treat the gateway as an authorization boundary and verify whether it can enforce per-action policy, not just log agent activity.

Agent access control and delegated privilege

Agent access control differs from traditional application access because the actor may select tools, chain requests, and continue operating without a human approving each step. Delegated privilege becomes especially sensitive when the agent can reach multiple systems through one session. That creates an identity graph in which one authorization decision can fan out into broader access than the original request suggested. The hard part is not authentication alone, but constraining how far delegated authority can travel once the agent begins acting.

Practical implication: map every downstream tool and API reachable from the agent’s first credential and limit the blast radius of that delegation chain.

Prisma AIRS and the control plane model

A control plane for autonomous agents is about centralising policy enforcement, visibility, and operational guardrails across many agent interactions. That model is attractive because point controls cannot keep pace with large agent estates that access SaaS, cloud, and internal systems. But centralisation does not solve the governance problem by itself. It only works if the control plane can express identity scope, approval boundaries, and revocation across the full agent lifecycle, including discovery, authorization, and offboarding.

Practical implication: benchmark any central AI governance platform against lifecycle controls, not just policy visibility or dashboard coverage.

NHI Mgmt Group analysis

Unified AI gateways are becoming the policy boundary for autonomous identity, not just a routing layer. Once an agent can choose tools at runtime, the meaningful control point is the place where identity scope is decided and enforced. That shifts governance attention away from isolated app permissions and toward the control plane that mediates every agent action. Practitioners should now evaluate whether their agent platform is actually an identity enforcement layer or merely a traffic path.

Least privilege for autonomous agents is a runtime problem, not a provisioning problem. Least privilege was designed for access that can be scoped before use and then reviewed after the fact. That assumption fails when an agent can alter its action path and tool set during execution. The implication is that security teams must rethink how privilege is expressed when intent is not fully knowable at issuance time.

Agent governance is collapsing the distance between PAM, NHI governance, and AI security operations. The same controls that once lived separately now need to coordinate around delegated access, approval boundaries, and offboarding for agents. That convergence is not cosmetic; it reflects a category shift in which non-human identity controls are being asked to govern autonomous behaviour. Practitioners should align policy, lifecycle, and runtime enforcement as one operating model.

Identity blast radius is the right concept for measuring agent governance maturity. The question is no longer whether an agent has access, but how far that access can propagate through connected systems, tokens, and tools before it is constrained. That makes the size of the reachable trust surface more important than the number of policies written. Security teams should measure the blast radius of each agent identity and shorten it wherever delegation expands unchecked.

Portkey’s integration into Prisma AIRS signals market consolidation around control planes, not point defenses. Buyers will increasingly be pushed to compare how platforms manage identity scope, runtime authorization, and lifecycle controls across multiple agent workloads. That does not remove the need for deep governance, but it does raise the bar for any tool that cannot span discovery, policy enforcement, and revocation. Practitioners should expect agent identity security to be evaluated as a platform capability, not a single feature.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Authorisation Guide

What this signals

Identity blast radius: autonomous agent programmes should be judged by how far one delegated identity can travel, not by how polished the onboarding flow looks. A narrow-looking grant can still fan out into tools, datasets, and downstream systems if runtime enforcement is weak.

Access reviews alone will not keep pace with agents that acquire and release privileges inside a single task. The governance question moves to issuance-time constraints, session boundaries, and revocation that can operate while the agent is still executing.

Platform consolidation around AI gateways suggests that buyers will increasingly expect one policy layer to cover discovery, authorization, and revocation. That expectation raises the bar for any programme still separating NHI lifecycle controls from agent runtime controls.

For practitioners

• Define agent authorization boundaries Map which tools, APIs, and datasets each autonomous agent can reach, then require explicit boundary checks before the first delegated action is allowed.
• Measure identity blast radius Inventory how far one agent credential can propagate across SaaS, cloud, and internal systems, and reduce any chain that crosses unrelated trust zones.
• Separate approval from runtime execution Do not assume a one-time onboarding approval covers the full session. Require enforcement that can re-evaluate agent action scope as the task unfolds.
• Tie offboarding to agent lifecycle events Revoke agent credentials and related tool permissions when the task, environment, or delegated purpose changes, not only when a human requests a reset.

Key takeaways

• This acquisition spotlights a shift from point AI controls toward a central governance plane for autonomous agent access.
• The core risk is scope drift during execution, when an agent’s effective authority can outgrow the approval that originally granted it.
• Practitioners should measure how far each agent identity can propagate and enforce controls that can intervene while the session is still active.

Key terms

• AI Agent Access: AI Agent Access is the permission an AI agent has to reach systems, data, and tools while it performs tasks on its own. It covers authentication, authorization, and control of what the agent can read, change, or trigger, usually through scoped credentials, policy checks, and monitored execution paths.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Unity AI Gateway: A centralized enforcement layer for AI workloads running across Databricks environments. It applies policy to model requests, tool calls, and agent interactions so organisations can control behavior consistently across workspaces. In practice, it gives security and governance teams one place to attach and enforce runtime rules.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.