Runtime governance for agentic AI needs a shared control model

At a glance

What this is: Noma Security says agentic AI runtime governance should converge on a shared control model because the decisive security point is the action boundary, not the model output alone.

Why it matters: IAM, PAM, and NHI teams need to treat agentic execution as a governed access problem because tool use, approval routing, and auditability now determine whether trust assumptions hold.

Context

Agentic AI runtime governance is the set of controls that decide whether an agent can execute a tool action, escalate for approval, or be stopped before impact. The article argues that this point of action is where security consequences become operational reality, so identity and policy controls have to move closer to execution.

For identity programmes, the challenge is no longer just who or what can authenticate into a system. It is whether the system can enforce intent, context, and authorisation at machine speed across dynamically chained actions, sub-agents, and third-party integrations.

Key questions

Q: What should security teams do when agent actions must be governed, not just observed?

A: They should enforce identity where the workload runs, use short-lived credentials, and reserve perimeter tools for visibility rather than control. That approach is most important for regulated data, production changes, and spend-bearing automations. If the business cannot tolerate ambiguous attribution, the control model is not strong enough yet.

Q: How do runtime controls change governance for agentic AI?

A: Runtime controls move governance from static inventory management to decision-time enforcement. That means policy, logging, and escalation rules must apply when the agent is about to act, not just when the system is deployed. The practical result is tighter control over trust inheritance, tool use, and unintended action paths.

Q: What are the warning signs that agent authorization is too static?

A: Warning signs include policy checks that ignore prior agent steps, approvals that happen only after the system has already taken the risky action, and logs that cannot reconstruct the identity chain. Those signals show that authorization is still being treated as a one-time event instead of a runtime decision.

Q: What should organisations do when agent actions need human review?

A: Organisations should define escalation thresholds for actions that are ambiguous, high impact, or poorly explained by context, then route them to the right approver before execution proceeds. The key is to defer safely rather than force a binary decision under uncertainty.

Technical breakdown

Action mediation and canonical decisioning

AARM describes an action mediation layer that intercepts tool invocations before execution and normalizes them into a canonical schema. That matters because runtime control only works when policy engines can evaluate the same action shape every time, regardless of which agent framework or vendor emitted it. The model is deliberately not a product feature set. It is a shared runtime contract for what must be visible, evaluated, and recorded before action proceeds. That contract matters most when actions are chained, because a single allow decision is no longer enough to describe the risk.

Practical implication: define an inline mediation point that all agent actions must pass through before execution.

Context accumulation and session-aware policy

The context accumulator is the control that makes runtime governance more than a simple allow or deny check. It keeps session state so the policy engine can evaluate what the agent has already done, not only the next action in isolation. That is important in agentic systems because intent drift, confused deputy conditions, and cross-step abuse often emerge across a sequence, not inside one command. In identity terms, this is closer to contextual authorization than static provisioning. It is also why upstream prompt and orchestration controls are necessary but insufficient: they do not on their own express how accumulated session context should alter authorization.

Practical implication: evaluate policy against session context, not only against the current request payload.

Approval routing, deferral, and tamper-evident receipts

AARM separates high-risk escalation from routine enforcement by routing some actions to human approval, suspending others through deferral when context is incomplete, and recording the decision in tamper-evident receipts. That combination is important because agentic systems can operate at machine speed while still needing human review for ambiguous or sensitive outcomes. The receipt layer then binds the action, identity chain, decision, and result into an auditable record that supports investigation. This is the runtime equivalent of insisting that privileged action leaves a durable evidence trail, not just a log line buried in telemetry.

Practical implication: require auditable receipts for escalated or deferred agent actions, especially where business impact is externalized.

Threat narrative

Attacker objective: The attacker aims to turn a seemingly authorized agent workflow into harmful real-world action without detection or effective approval control.

1. Entry occurs when an agent receives trusted and untrusted context in the same session and uses that context to invoke tools dynamically.
2. Escalation happens when the agent chains actions, delegates to sub-agents, or follows manipulated intent while still operating within formally authorized boundaries.
3. Impact follows when the system executes the wrong real-world action, producing exfiltration, fraud, privilege misuse, or unintended operational change.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• 12,000 secrets in LLM training data: Truffle Security found 11,908 live API keys and passwords hard-coded in web pages captured by Common Crawl, a dataset used to train LLMs.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime governance is becoming the decisive control plane for agentic AI. The article is right to separate model quality from action governance, because the security outcome is determined when the agent acts, not when it reasons. That shifts the practitioner problem from content moderation to enforceable authorization at runtime. For identity teams, the implication is clear: the control that matters most is the one that can stop, modify, or escalate action before impact.

Open specifications matter because agentic control fragmentation will become governance debt. Identity and security history shows that proprietary control models create integration drag, inconsistent semantics, and brittle audit trails. The article’s comparison to OAuth, OpenID Connect, OPA, and ATT&CK is well grounded: shared language accelerates operational maturity even when the standard does not solve the whole problem. Practitioners should expect runtime governance to become a platform selection issue unless common conformance takes hold.

The assumption that authorization can be decided once, before execution, is breaking down. Traditional IAM assumes the actor’s intent and action path are knowable enough at provisioning or request time to authorize within stable bounds. That assumption fails when an agent can chain tools, delegate, and adapt mid-session. The implication is not merely stronger access control, but a rethink of when authorization actually happens for autonomous action.

Action-boundary governance exposes a new kind of identity blast radius. An agent may be formally permitted to read data, send email, or call systems, yet still create harmful outcomes when those permissions combine under manipulated context. That means runtime policy must reason about the composition of allowed actions, not just the presence of each permission in isolation. Practitioners should treat action combination risk as a first-class governance problem.

Receipt-level auditability will become a baseline expectation for agent controls. The receipt generator described in the article is not just a logging enhancement. It is the evidence mechanism that makes runtime decisions reviewable across identity, policy, and outcome. Without durable receipts, agent governance cannot support accountability at the speed the systems operate. Teams should expect audit design to move closer to the action layer.

What this signals

Action-boundary governance will become a core design constraint for agent programmes. Teams should assume that model-centric controls will not be enough once agents can chain tools and continue under altered intent. The programme question shifts to where enforcement sits, how decisions are made at runtime, and what evidence survives each action.

Shared runtime semantics will matter as much as shared identity semantics. If every vendor defines agent action control differently, organisations will inherit a new generation of policy drift and audit fragmentation. The practical response is to treat conformance and interoperability as security requirements, not procurement preferences.

Receipts, escalation, and deferral are the three runtime signals practitioners should watch. If a platform cannot prove what it decided, why it escalated, or when it deferred, it is leaving governance gaps that become visible only after impact. That is the boundary where agentic risk becomes operational.

For practitioners

• Define an action boundary for agent governance Map where tool invocation becomes a controlled business action and require mediation before execution crosses that line.
• Require session-aware policy evaluation Ensure policy decisions account for accumulated context, prior steps, and delegated actions rather than evaluating each request in isolation.
• Route ambiguous actions to human approval Create escalation rules for high-risk or insufficiently contextualised agent actions so the system can defer instead of guessing.
• Bind runtime decisions to tamper-evident receipts Preserve the action, identity chain, decision, and outcome in records that support investigation and control validation.

Key takeaways

• Agentic AI changes the identity problem from static permission assignment to runtime control over actions, context, and delegated execution.
• The article’s central warning is that proprietary runtime models would create long-lived interoperability and audit problems if the market fragments early.
• Practitioners should focus on mediation, session-aware policy, human escalation, and evidence-grade receipts at the point where the agent acts.

Key terms

• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Action Boundary: The action boundary is the point where a user or system turns a request into a business-impacting decision, such as a payment approval or access grant. It is the most important place to add controls when attackers are using legitimate-looking messages to redirect trusted workflows.
• Intent Drift: A mismatch between the original purpose of an agent session and the outcome produced by a later chain of actions. It matters because each step can be individually permitted while the overall behaviour still becomes unsafe or non-compliant.
• Tamper-Evident Receipt: A tamper-evident receipt is a durable record that proves an authorization decision happened and shows what policy, context, and approver supported it. For autonomous systems, receipts are more valuable than ordinary logs because they preserve evidence of control at the moment of execution.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.