TL;DR: AI applications only expose their real attack surface at runtime, and LEVO argues that traditional security tools miss the machine-to-machine interactions, identity drift, and data flows that determine whether agentic systems can move safely from pilot to production. The security model now has to follow execution, not just deployment, because governance fails when AI is treated like static software.
At a glance
What this is: LEVO frames runtime AI visibility as the missing control plane for AI systems whose attack surface emerges only when agents, APIs, LLMs and data flows execute together.
Why it matters: For IAM, NHI and AI security teams, the message is that governance must follow execution, because delegated tokens, machine identities and dynamic tool calls cannot be managed safely from static design-time views alone.
By the numbers:
- Gartner reported a 750% surge in AI-agent inquiries between Q2 and Q4 2024.
- About 32% of enterprises exploring AI agents stall at pilot stage and are never deployed in production.
Context
Runtime AI visibility is the ability to observe and govern AI systems while they are actually executing. The control gap exists because AI applications do not present a fixed perimeter, so identity, data access and tool use have to be understood in motion rather than assumed from design-time architecture.
This matters to identity teams because the article describes agents using delegated tokens, non-human identities changing privilege during a session, and machine-to-machine workflows that traditional north-south monitoring misses. In practice, the governance problem is not only where AI is deployed, but who or what is allowed to act once execution begins.
LEVO presents runtime visibility as the missing basis for moving AI from pilot to production. That starting position is now typical for serious enterprise AI programmes, because static review models cannot keep pace with dynamic agent behaviour and contextual API use.
Key questions
Q: What breaks when AI security stops at posture instead of runtime behaviour?
A: Security teams lose visibility into the actions that matter most, such as API calls, record access and tool use. Posture tools can show what was deployed and how it was configured, but they cannot prove what the AI system actually did once it started operating. That makes runtime governance and identity correlation essential.
Q: Why do delegated tokens and NHI access create governance risk in AI systems?
A: They create risk because the identity that authorises an action is often not the same identity that executes it, and the effective privilege can change mid-session. That breaks traditional review models built around static entitlements. Security teams need runtime traceability of authorisation, execution and token scope to preserve accountability.
A: Security teams should treat agentic AI as an identity class that needs continuous observation, not just initial authorization. Governance has to cover who or what gets a secret, how it is used, and whether the observed runtime behaviour matches the intended task. That means combining policy, detection, and rapid remediation so access stays aligned with actual agent activity across the full secret lifecycle.
Q: What is the difference between runtime AI visibility and pre-production testing?
A: Pre-production testing checks expected behaviour in controlled conditions, while runtime visibility shows how the system behaves under real prompts, data and delegation patterns. AI systems change with each execution, so testing alone cannot expose emergent tool use, privilege aggregation or shadow data flows. The two are complementary, but only runtime visibility proves control in production.
Technical breakdown
Why AI attack surfaces appear only at runtime
AI applications are not fixed systems in the way monolithic software is. Agents plan and call tools dynamically, RAG pipelines fetch context on demand, and APIs are invoked according to the live conversation or task. That means the full attack surface is recomposed during execution, not fully knowable from a pre-release scan. The architectural consequence is that security controls must observe interaction patterns, not just deployed components. For IAM and NHI governance, this shifts attention from static inventory to live authority and session behaviour.
Practical implication: move security review from design-time assumptions to runtime observation of active agents, tools and data paths.
Why east-west AI traffic defeats legacy security tooling
Legacy security tools were built for perimeter-oriented user-to-application traffic, not for dense machine-to-machine behaviour inside applications. AI systems intensify that problem because agents, LLMs, MCP servers and APIs create short-lived, contextual interactions that may never touch the edge in a meaningful way. When observability depends on boundary logs, most of the real control problem stays hidden. In identity terms, the execution chain matters more than the login event, because delegated access can be exercised across multiple hops without a single clean review point.
Practical implication: instrument internal AI traffic and delegation paths, not just perimeter events and logins.
How identity drift and delegated access change AI governance
The article’s strongest governance point is that AI systems blur the line between authorisation and execution. An agent may act through delegated tokens, a non-human identity may inherit capabilities mid-session, and a chain of tools can aggregate privileges in ways that no single component appears to own. That creates identity drift, where the effective authority at runtime no longer matches the approved authority on paper. For NHI and agentic AI programmes, this is the control-plane problem: without live mapping of who authorised and who executed, governance cannot prove accountability or enforce least privilege.
Practical implication: map authorisation to execution in real time so delegated NHI and agent actions remain inside approved scope.
Threat narrative
Attacker objective: The attacker objective is to exploit invisible runtime AI interactions to access data, manipulate workflows or trigger downstream decisions without being detected in time.
- Entry occurs through normal AI execution, where an agent invokes tools, APIs or retrieval sources that are not fully visible to static security controls.
- Credential and privilege abuse follow when delegated tokens, MCP access or non-human identities are used beyond the scope that design-time review assumed.
- Impact appears as data exposure, model poisoning, fraudulent approval paths or systemic workflow failure because the runtime chain could not be observed and constrained.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
- Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime AI visibility is becoming the control plane for AI governance, not an optional telemetry layer. Once agents, MCP servers and APIs begin interacting dynamically, the question is no longer whether the model is accurate enough, but whether the organisation can see and constrain what actually happens. That changes AI governance from a policy exercise into a live execution problem. Practitioner conclusion: if you cannot observe runtime behaviour, you cannot claim control.
The named concept here is runtime identity drift: the gap between the authority approved for an AI system and the authority actually exercised during execution. This article shows that delegated tokens and non-human identities can change effective privilege across hops, which makes static entitlement review insufficient. The governance failure is not merely excess access, but access whose shape mutates faster than review cycles can catch it. Practitioner conclusion: prove runtime identity continuity before scaling agentic workflows.
Traditional security tools are structurally misaligned with AI-native systems because they still privilege perimeter visibility over execution visibility. That is why detection, protection, debugging and remediation all degrade together once the runtime mesh becomes the real system boundary. For identity programmes, the intersection is explicit: machine identities and delegated access become operational controls, not just directory records. Practitioner conclusion: build observability around execution paths, not around inherited network assumptions.
AI production readiness now depends on proving control over machine-to-machine behaviour, not simply passing a pre-launch checklist. The article correctly links stalled pilots to an inability to demonstrate security and compliance under real operating conditions. That is the same pattern identity teams see when governance stops at provisioning and never reaches runtime use. Practitioner conclusion: treat production approval as an evidence problem, not a design review problem.
Runtime AI visibility also reframes agentic AI as an identity-security issue, not just an application-security issue. Once an agent can call tools, reach data and aggregate permissions, its identity becomes the primary trust boundary. That means agent authorisation, token scope and session traceability belong inside the core governance model. Practitioner conclusion: align AI controls with identity governance and auditability requirements from day one.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Runtime identity drift: AI governance will increasingly fail where organisations cannot reconcile who authorised an action with which non-human identity executed it. The control point moves from static provisioning to live session traceability, especially in agent chains that combine delegated access and contextual tool use.
Enterprises should expect AI security programmes to converge on observability, authorisation and audit evidence as one control plane. Runtime AI visibility is not just a monitoring problem, it is the mechanism that makes NHI governance and agentic AI accountability defensible in production.
For practitioners
- Inventory active AI components at runtime Create a live register of agents, MCP servers, LLMs, APIs and third-party integrations, including parent application ownership and usage frequency.
- Trace identity and token usage across agent chains Record who authorised a workflow, which non-human identities executed it, and how delegated token scope changed across each hop.
- Instrument east-west AI traffic for auditability Capture prompts, responses, retrievals and downstream API calls so compliance teams can reconstruct causality after an incident or review.
- Tie policy decisions to runtime behaviour Use live execution evidence to decide whether an agent may read data, call tools or trigger business actions, rather than relying only on pre-production tests.
- Monitor for privilege aggregation in multi-agent workflows Identify cases where multiple agents collectively gain capabilities that no single agent should hold, especially when one reads and another acts.
Key takeaways
- AI systems do not reveal their full attack surface until they are running, which makes runtime observability a governance requirement rather than an optional enhancement.
- Delegated tokens, MCP access and multi-agent workflows can create identity drift that static reviews miss, especially when privilege changes during execution.
- Security teams need live evidence of who authorised, who executed and what data moved if they want to scale AI beyond pilot safely.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Runtime AI systems rely on delegated tokens and machine authentication paths that can drift at execution time. |
| NHI-05 — Overprivileged NHI | The article highlights agent chains and delegated identities that can combine privileges beyond intended scope. | |
| Recommendation — Audit runtime authentication paths for agents and revoke token patterns that cannot be traced end to end. Limit agent and MCP permissions to the minimum runtime scope needed for each workflow. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent privilege drift and delegated access are central to the article's runtime control problem. |
| Recommendation — Map agent delegation paths and restrict any identity chain that can aggregate privileges across tools. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Delegated tokens and runtime credentials need lifecycle control as they are issued and exercised. |
| Recommendation — Manage AI authentication tokens with expiry, traceability and revocation controls. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about whether AI access rights remain controlled during live execution. |
| Recommendation — Continuously validate AI entitlements against approved runtime use and revoke excess access. | ||
Key terms
- Runtime AI Visibility: Runtime AI visibility is the ability to observe how AI systems actually behave in production, including agent actions, tool calls, data flows, and identity use. It is the control layer that turns AI execution from an assumption into evidence, which is essential for governance, investigation, and safe scale.
- Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
- MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
- Delegation Token: A delegation token is a short-lived credential that allows one identity to perform a narrowly defined task on behalf of another identity. In AI agent environments, it should limit scope, duration, and downstream propagation so chained actions do not become broader than the approved purpose.
Deepen your knowledge
NHI Mgmt Group’s NHI Foundation Level course covers NHI governance, agentic AI identity, machine identity security and secrets management through the industry’s only accredited NHI security programme. It helps practitioners connect identity governance to the operational controls needed to scale AI and other identity-heavy systems responsibly.
Published by the NHIMG editorial team on September 6, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org