Runtime-informed posture shows what AI agents do, not just can do

At a glance

What this is: This is an analysis of runtime-informed AI-SPM, showing that AI agent risk must be read through the gap between configured posture and operational posture.

Why it matters: It matters because IAM, NHI, and agent governance teams need evidence of what agents actually exercised, not only what policy said they could exercise.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read ARMO's full analysis of runtime-informed posture for AI agents

Context

Runtime-informed posture is the discipline of comparing what an AI agent is configured to do with what it actually does at runtime. In AI agent security, that distinction matters because policy, deployment intent, and observed behaviour often diverge within the same production window.

The core governance gap is that static AI-SPM only sees declared controls, while operational telemetry reveals inherited access, tool use, and behavioural drift. For teams managing NHI, agentic AI, or broader IAM programmes, the question is no longer whether the agent is authorised in theory, but which identities, tools, and actions are visible in practice.

This framing is typical of mature AI workloads: a system can look tightly governed in configuration and still exhibit a materially different operational posture once it begins interacting with models, tools, MCP servers, and cloud APIs.

Key questions

Q: How should security teams govern AI agents that can change behaviour at runtime?

A: Security teams should govern AI agents with runtime monitoring, behavioural baselines, and identity-triggered response, not just static approval workflows. The goal is to detect when an agent drifts from expected purpose, reduce privileges immediately, and keep accountability tied to a named owner. In agentic environments, governance must work at machine speed rather than review cadence speed.

Q: Why do AI agents create hidden access scope in identity programmes?

A: Because their effective authority can expand through inherited bindings, federated credentials, runtime-loaded tools, and changing service dependencies. The immediate policy attached to the agent often understates the real access path. Identity teams need to trace the full chain of authority before they can say the scope is understood.

Q: What breaks when teams rely on static AI-SPM for agent governance?

A: Static AI-SPM can show declared permissions, but it cannot prove exercised behaviour or evolving runtime scope. That means teams may miss unused privilege, inherited authority, or behaviour that changed without a policy change. The result is false confidence in governance evidence that only covers configuration.

Q: How should security teams detect risky AI agent behaviour in production?

A: Security teams should detect risky AI agent behaviour by monitoring runtime decisions, tool selection, action sequences, and deviations from the approved use case. Authentication alone is not enough. The useful signal is whether the agent is still acting within the behavioural envelope defined by its purpose and ownership model, especially when it operates across multiple systems.

Technical breakdown

Configured posture versus operational posture in AI agents

Configured posture is the set of controls declared at deploy time: IAM scope, RBAC bindings, network policy, mounted secrets, service mesh authorization, and the agent’s own declared models, MCP servers, and tool catalog. Operational posture is the runtime record of what the agent actually touched: API calls, tool invocations, network egress, file access, identity hops, and models loaded into memory. A runtime-informed system reads the difference between these two artifacts, not one in isolation. That is why static AI-SPM and runtime telemetry answer different questions, even when they look similar on a dashboard.

Practical implication: teams should treat configured and operational posture as separate evidence streams and reconcile them continuously.

Why AI agent posture splits into three gap types

The article’s three-gap model is useful because each gap has a different cause. Latent capability means configuration permits something the agent never uses. Hidden effective scope means inheritance, federation, or runtime loading creates broader real-world authority than the immediate config shows. In-scope anomaly means the authorized surface is unchanged, but the pattern of use has shifted. Those are not interchangeable findings. Each one needs different evidence, and each one fails if you apply the wrong reduction path.

Practical implication: classify every finding by gap type before changing policy, or you risk fixing the wrong layer.

Why eBPF and application-layer correlation both matter for AI agents

For AI agents, runtime evidence is not just a syscall stream or a cloud audit log. Kernel-layer eBPF can show process and API behaviour, but it cannot explain intent, prompt context, or tool selection on its own. Application-layer correlation adds the missing context by linking runtime events to the agent workflow that produced them. Without both layers, teams can see activity but not the identity behaviour that created it. That is the difference between generic observability and usable identity posture.

Practical implication: build runtime evidence around both kernel and application signals, or the posture view will stay incomplete.

Threat narrative

Attacker objective: The objective is to exploit the gap between configured and operational posture so that agent behaviour exceeds the governance model that security teams believe is in place.

1. Entry begins when an AI agent is deployed with configured permissions, connected tools, and inherited runtime dependencies that define its effective surface.
2. Escalation occurs when the agent’s operational posture expands through runtime loading, transitive bindings, or changing MCP tool catalogs beyond what the immediate config enumerates.
3. Impact appears when teams mistake the static view for the full truth and miss either exposed capability, hidden effective scope, or behavioural drift that changes risk outcomes.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Configured posture is not evidence of operational control: Security teams still over-read static AI-SPM because it tells them what the agent was allowed to do, not what it actually exercised. That gap becomes material the moment runtime inheritance, tool loading, or agent behaviour changes after deployment. The practitioner conclusion is that configuration review alone cannot establish real control.

Hidden effective scope is the most undercounted AI identity problem: The article correctly shows that effective authorization can be broader than an agent’s immediate policy surface once inheritance and runtime resolution are included. That is the same governance failure pattern that appears in NHI when downstream policy is narrower than upstream authority. The practitioner conclusion is to inspect the full authorization graph, not just attached policy.

In-scope anomaly is the hardest gap to govern because the permission set is correct: When authorised behaviour changes shape, the security problem is no longer access granted or denied, but the pattern of exercise. That is where behavioural baselining, prompt-context correlation, and per-agent enforcement become more important than IAM edits. The practitioner conclusion is that detection and posture must meet in the same operating model.

Identity posture for AI agents now spans three disciplines that mature at different speeds: Model and artifact, identity and access, and behavioural posture do not converge together. A team can be runtime-informed in one and still static in the others, which creates an asymmetric-maturity exposure that dashboards often hide. The practitioner conclusion is to measure maturity by discipline, not by platform label.

Runtime-informed posture exposes an identity governance assumption that no longer holds: Least privilege is easy to define at provisioning time was designed for actors whose intent is stable before execution begins. That assumption fails when an AI agent’s effective scope changes through runtime resolution, tool discovery, or context-driven action selection. The implication is that provisioning-time governance is no longer the full control plane for AI agent identity.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• From our research: Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
• Runtime-informed governance only matters when it changes how teams measure access, not just how they visualise it.

What this signals

Runtime-informed AI agent governance will become a baseline expectation, not an advanced capability: with 98% of companies planning more AI agents, the pressure on identity teams will shift from proving static authorization to proving operational behaviour across the same control plane. That means dashboards built only for declared permissions will age out quickly.

Hidden effective scope will be the hardest posture gap to normalise: the practical problem is no longer whether an agent has access, but whether inherited authority, runtime loading, or tool discovery expands that access beyond the immediately attached policy. Teams that cannot trace the whole chain will keep misclassifying exposure as acceptable scope.

Identity programmes should expect AI agent evidence requests to move toward reconciled posture artefacts, because auditors and incident responders will want to know what the system did, not only what it could have done.

For practitioners

• Split static and runtime evidence immediately Track configured posture and operational posture as separate artefacts for every production agent. If one view is missing, you cannot tell whether a finding is latent capability, hidden effective scope, or in-scope anomaly.
• Classify findings by gap type before remediation Label each alert as latent capability, hidden effective scope, or in-scope anomaly before changing policy. Replacing policy on the wrong gap often reintroduces the same finding on the next reconciliation cycle.
• Trace the full identity chain behind each agent Review inherited bindings, federated credentials, MCP server catalogs, and namespace-level policies together so the agent’s immediate config does not mask upstream authority.
• Correlate kernel events with prompt and tool context Use runtime correlation that links API calls, tool use, and prompt context to the same session so behavioural shifts can be distinguished from ordinary workload noise.
• Measure maturity by discipline, not by platform badge Assess whether your stack is truly runtime-informed across model and artifact, identity and access, and behavioural posture, instead of assuming one instrumentation layer covers all three.

Key takeaways

• AI agent governance fails when teams confuse configured permission with operational behaviour.
• Hidden effective scope and in-scope anomaly require different evidence, different controls, and different remediation paths.
• Identity programmes must reconcile static and runtime posture if they want defensible control over AI agents.

Key terms

• Configured posture: Configured posture is the set of permissions, policies, and declared dependencies applied to an AI agent at deploy time. It shows intended access, not exercised access. In practice, it is the static baseline that identity and security teams must compare against runtime behaviour to understand real risk.
• Operational posture: Operational posture is the set of access events, tool calls, network actions, identity hops, and runtime-loaded components an AI agent actually performs. It is built from observed behaviour rather than declared intent. For governance, it is the evidence layer that shows what the agent really did.
• Hidden effective scope: Hidden effective scope is the access an AI agent truly has once inheritance, federation, runtime loading, and upstream policies are included. The immediate configuration may look narrow while the real authority is wider. This matters because teams often review only the direct policy attached to the agent.
• In-scope anomaly: In-scope anomaly is a change in the pattern of authorized behaviour without a change in the permission set itself. The access remains valid, but the sequence, frequency, or context shifts in a way that may indicate drift or abuse. It is a behavioural governance problem, not a policy one.

What's in the full article

ARMO's full blog covers the operational detail this post intentionally leaves for the source:

• The exact three-gap taxonomy and the examples ARMO uses to distinguish latent capability from hidden effective scope.
• The instrumentation discussion behind eBPF-based runtime visibility and how the platform correlates kernel and application signals.
• The L2-to-L3 maturity transition model for runtime-informed AI-SPM and how the findings queue changes as posture becomes reconciliation-led.
• The FAQ examples that map posture findings to practitioner decisions in live AI agent environments.

👉 ARMO's full blog covers the three-gap taxonomy, runtime evidence model, and maturity transition in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.