TL;DR: Agentic AI systems now plan, decide, and execute at machine speed, so the security boundary has shifted from model output to the action itself, according to EnforceAuth's unified reference architecture. Access review processes assume privilege persists long enough to be reviewed; autonomous actors can create, use, and discard access within a single session, leaving that assumption broken.
At a glance
What this is: This is a reference architecture for runtime authorization in agentic AI, with the central claim that security now hinges on evaluating every autonomous action before it executes.
Why it matters: It matters because IAM, PAM, and NHI programmes built around static entitlements and periodic review do not adequately govern systems that plan, call tools, and trigger workflows at machine speed.
Context
Agentic AI changes the control problem from who logged in to what action was allowed to happen. In this model, the identity layer is not enough because the system can accumulate context, invoke tools, and trigger downstream workflows without a human checkpoint on every step.
For identity teams, the key issue is runtime authorization, not model output moderation. The article frames this as a governance gap across autonomous systems, where access review, policy documentation, and general observability do not by themselves stop an unsafe action.
The article's starting position is typical of production agentic deployments: capable, fast-moving, and governed by controls that were designed for slower human or service-account decision cycles.
Key questions
Q: What breaks when AI assistants rely only on built-in safety filters?
A: Built-in safety filters fail when attackers use obfuscation, multi-turn escalation, or indirect prompt injection to change the model’s interpretation of allowed behaviour. The result is that the session still looks valid while the output or action becomes unsafe. Enterprises then lose visibility into the coercion path until data has already moved.
Q: Why do autonomous agents make traditional access reviews less effective?
A: Access reviews assume permissions persist long enough to be observed, challenged, and recertified. Autonomous agents can obtain, use, and discard access within a single session, which means the risky action may occur before the next review cycle. That makes runtime enforcement more important than periodic certification alone.
Q: What are the signs that agentic AI controls are too weak?
A: The warning signs are capability exposure and late-stage detection. If your programme depends on the model to recognise malicious prompts, and your alerting only fires after data has already left the environment, the control set is backwards. That means containment is missing and the agent can still turn ordinary tasks into exfiltration paths.
Q: Should organisations treat agent identity and runtime authority as the same control?
A: No. Agent identity tells you which actor is involved, but runtime authority decides whether a specific action should happen now. Identity assignment without action mediation leaves a gap between authentication and enforcement, which is where most agentic AI failures begin.
Technical breakdown
Why model output filtering does not control agent actions
AI safety and AI security are different boundaries. Output filtering constrains what the model says, but runtime authorization constrains what the agent does with tools, data, and downstream workflows. That distinction matters because an agent can produce harmless-looking text and still execute a privileged API call, approve a transfer, or expose regulated data. The control point therefore moves from content inspection to decision mediation. In architectural terms, the policy engine has to sit on the action path, not around the model wrapper. Practical implication: treat model moderation as a supporting signal, not the control that governs execution.
Practical implication: place policy enforcement in front of every tool call and workflow trigger, not just around prompts or outputs.
Why static identity is insufficient for autonomous systems
Traditional IAM answers who the actor is and what it was assigned at provisioning time. Autonomous systems break that model because they can chain calls, delegate to sub-agents, and hold standing credentials across long sessions while their context keeps changing. That makes the effective privilege state dynamic, not fixed. The article's point is that identity labels alone cannot answer whether a specific action, in a specific session, should proceed. A runtime control must evaluate identity, intent, context provenance, and reversibility together. Practical implication: scope autonomous identities as actively mediated actors, not as static accounts with a one-time approval boundary.
Practical implication: govern agent identity as a runtime state, not as a provisioning event.
How authorization receipts change auditability for agentic AI
Logs tell you what happened after the fact. Receipts are tamper-evident records of what was authorised before the action executed, which is a different assurance model. That distinction becomes important when the risk is not just detection but proof that a high-consequence action passed through policy with the right context and approvals. In the article's framework, receipts sit alongside observability, but they are not the same thing. Observability supports detection and tuning; receipts support accountability. Practical implication: retain decision records for irreversible or high-consequence agent actions, especially where auditors or regulators will ask who authorised the action and on what basis.
Practical implication: separate operational telemetry from decision evidence so you can prove authorisation, not merely reconstruct events.
Threat narrative
Attacker objective: The attacker wants the agent to perform a legitimate-looking action that creates unauthorized business, data, or supply-chain impact under borrowed authority.
- Entry occurs when an attacker injects malicious instructions into content an authenticated agent is allowed to read, or when a third-party integration is granted standing credentials that should have been scoped more tightly.
- Credential or authority abuse follows when the agent uses inherited operator permissions, OAuth tokens, or other standing access to call tools the human never evaluated step by step.
- Escalation happens when the agent chains actions across workflows or sub-agents, turning one authorised request into a broader sequence of unaudited downstream effects.
- Impact is achieved when the system executes an irreversible action, exfiltrates data, or propagates attacker-controlled changes through production workflows under legitimate authority.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Runtime authorization is the missing control plane because autonomous systems turn every tool call into a governance decision. The article is right to separate AI safety from AI security. Once an agent can choose actions at runtime, policy has to sit on the execution path rather than around the model perimeter. Practitioners should stop treating prompts, outputs, and human review as substitutes for enforcement.
The existing access review model is built for privileges that persist long enough to be reviewed. That assumption fails when an agent can obtain, use, and discard access inside one session or one task. The implication is not simply tighter review cadence, but a different mental model for where authority lives and when it is actually enforceable.
Least agency is the more accurate control objective than least privilege for autonomous actors. The article's framing correctly distinguishes what an identity may access from what an autonomous system may decide to do. That distinction matters because agentic risk is created by action selection, not only by data reach. Practitioners should govern decision scope, not just entitlement scope.
Receipts will become the audit boundary for agentic AI governance. Logs are retrospective, but autonomy requires pre-execution evidence that a specific action was authorised with the right context, reversibility, and oversight. That is why runtime decision records matter to regulators, auditors, and internal control owners. Teams should expect evidence requirements to shift from observation to authorisation proof.
Security programmes will converge on a single question: who authorised the action, not which model produced it? The article captures the market direction accurately. Governance, identity, and observability only become meaningful when they are anchored to the action plane. Practitioners should design their control stack around enforceable decisions, not around model reputation or lifecycle policy alone.
From our research library:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Security Guide
What this signals
Least agency becomes the more useful design principle once AI systems can select and chain actions at runtime. That is a shift from provisioning-centred IAM to decision-centred enforcement. Programmes that still treat autonomy as an extension of automation will miss the point that authority now needs to be bounded at execution time, not just at onboarding.
Access review alone is structurally mismatched to autonomous behaviour. A session can create and consume access faster than a review cycle can ever certify it. That is why teams should move their control discussions from entitlement recertification to runtime policy mediation and tamper-evident decision records.
53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey. That expectation makes runtime authorization an operational planning issue, not a future architecture debate. Security teams need controls that can evaluate agent action before execution, not after the fact.
For practitioners
- Define the action boundary Map every tool call, API invocation, and workflow trigger that an autonomous system can execute, then require policy evaluation before any of them proceed.
- Separate identity from authority Assign unique, revocable identities to agents and sub-agents, but do not assume identity assignment alone governs what the system may decide to do.
- Add runtime decision controls Classify irreversible and high-consequence actions so they are intercepted for context, intent, and reversibility checks before execution.
- Record tamper-evident receipts Store a decision record for each authorised agent action, including the policy outcome and the approval context that justified the execution.
Key takeaways
- Autonomous AI changes governance from access assignment to action authorization, which makes runtime controls more important than output moderation.
- Standing credentials, shared identities, and session-long delegated access create a control gap that periodic review does not close.
- The practical control objective is to prove which actions were authorised, not just to log what the system did.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents acting under borrowed or overbroad authority at runtime. |
| Recommendation — Constrain agent privilege by mediation at execution time, not by identity labels alone. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Autonomous systems rely on identities and credentials that must be continuously verified at runtime. |
| NHI-05 — Overprivileged NHI | The article repeatedly warns that standing access and inherited authority create agentic risk. | |
| NHI-10 — Human Use of NHI | The compromise examples show human and operator authority being exercised through agent identities. | |
| Recommendation — Verify agent authentication and session context before each high-consequence action. Reduce standing access for agents and scope authority to the minimum action set required. Prevent operators from delegating irreversible actions to agents without explicit runtime checks. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The incident pattern involves stolen authority becoming broad downstream access through chained actions. |
| Recommendation — Map agent abuse paths to credential access and lateral movement tactics in detection engineering. | ||
| NIST AI RMF | MANAGE — Manage AI Risk | The article is fundamentally about governing AI risk through operational controls and accountability. |
| Recommendation — Embed runtime authorization, oversight, and evidence capture into AI risk management. | ||
| NIST Zero Trust (SP 800-207) | Control plane — Policy enforcement point | Zero trust logic is used here to justify continuous evaluation of each autonomous action. |
| Recommendation — Treat each agent action as untrusted until policy authorisation has been evaluated. | ||
Key terms
- Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
- Least Agency: The agentic equivalent of least privilege, the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
- Authorization Gap: The distance between what an authenticated identity can do and what it is actually permitted and proven to do in real time. For AI agents, the gap widens when decisions are made per action, at machine speed, and through workflows that expand faster than human review cycles.
- Decision Receipt: A signed record of a control decision such as permit, deny, redact, or approve. It contains the canonical payload, hashes, signatures, and verification metadata needed to prove the record existed and remained intact after creation.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org