Securing agentic AI and MCP requires runtime identity controls

At a glance

What this is: This is an analysis of why agentic AI and MCP require runtime identity enforcement, not just model-output review.

Why it matters: It matters because IAM, PAM, and NHI controls must now govern tool use, delegated authority, and auditability across human, workload, and agentic identities.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope.

👉 Read Trust3's guide to securing agentic AI and MCP

Context

Agentic AI changes the security problem from output review to action control. Once an agent can plan, call tools, read databases, write files, send email, and delegate work, traditional governance based on model responses no longer covers the real attack surface. The key identity question is no longer only what the model says, but what the actor can do at runtime.

Model Context Protocol, or MCP, makes that shift more urgent because it connects agents to tools and data sources. In practice, the risk sits in the relationship between the agent’s delegated authority, inherited credentials, and the permissions attached to every tool connection. That is why the article’s topic belongs squarely in NHI governance and agentic AI identity, not model-risk theory alone.

Key questions

Q: How should security teams govern agentic AI that can execute IAM tasks?

A: Start by treating the agent as an NHI with bounded authority, explicit ownership, and revocation procedures. Require human approval for high-risk actions, log every decision path, and enforce least privilege at the workflow level. If the agent cannot be audited or rolled back, it is not yet ready for autonomous IAM execution.

Q: Why do MCP-connected agents create harder access-control problems than chatbots?

A: Because they can turn model output into real actions. A chatbot can be wrong without consequence, but an MCP-connected agent can write files, call APIs, or trigger workflows. That means tool identity, caller identity, and argument validation all matter, not just the quality of the model’s response.

Q: What breaks when least privilege is designed before an AI agent starts working?

A: What breaks is the assumption that the needed scope is knowable in advance. AI agents decide and adapt at runtime, so pre-assigned permissions tend to overestimate what the agent actually needs. That creates standing access that outlives the task and turns least privilege into a guess rather than a control.

Q: Who is accountable when an autonomous AI agent causes a security incident?

A: Accountability should rest with the organisation that deployed the agent, the owner of the delegated workflow, and the governance function that approved the operating model. A durable identity chain and decision record are essential, because liability and oversight cannot depend on an invisible or shifting human operator inside the execution path.

Technical breakdown

Why output-level AI governance fails for tool-using agents

Output-level governance assumes the risky event is what the model says. Agentic systems break that assumption because the security boundary is the action sequence, not the text response. An agent can compose several individually defensible steps into an abusive workflow by chaining tools, moving data across systems, and passing work to other agents. The control problem is therefore runtime authorisation of delegated actions, not post-hoc inspection of model output. Once tool calls are possible, every connection expands the effective identity perimeter.Practical implication: security teams need controls that evaluate each action before execution, not after the model has already produced a response.

Practical implication: security teams need controls that evaluate each action before execution, not after the model has already produced a response.

How MCP expands the non-human identity attack surface

MCP is a protocol layer that lets an agent connect to tools, but it also inherits the trust problems of every connected server. If tool descriptions can be poisoned, if credentials are broad, or if tool responses can inject instructions back into the agent, the protocol becomes part of the attack surface. The article’s core point is that permissive defaults are dangerous because the agent treats connected content as trusted context. This is a governance problem for non-human identities because the authority is being exercised through machine-to-machine delegation.Practical implication: every MCP server should be treated as untrusted until it is verified, scoped, logged, and constrained by policy.

Practical implication: every MCP server should be treated as untrusted until it is verified, scoped, logged, and constrained by policy.

Why delegated authority needs runtime least privilege

Least privilege for agentic systems cannot be reduced to static role assignment. An agent’s purpose changes from prompt to prompt, and a role that is broad enough to keep work flowing becomes broad enough to leak data or trigger unwanted actions. The technical issue is not simply access volume, but access composition: three narrow permissions can combine into an exfiltration path when the agent is free to sequence them. That is why the article stresses scoped tokens, purpose-based access, and live policy enforcement.Practical implication: access should be issued per action and per purpose, with immediate revocation when the task boundary ends.

Practical implication: access should be issued per action and per purpose, with immediate revocation when the task boundary ends.

Threat narrative

Attacker objective: The objective is to make an authenticated agent carry out authorised-looking steps that together produce data loss, misuse, or lateral access.

1. Entry happens when an agent connects to tools through MCP and inherits credentials that were not designed for the full delegated workflow.
2. Escalation occurs when individually permitted tool calls are chained into a multi-step workflow that moves data, writes files, or sends it onward without a human review gate.
3. Impact is achieved when the agent completes an exfiltration or unsafe action path that no single control flagged because the misuse emerged from composition rather than one bad request.

Breaches seen in the wild

• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.
• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Output governance is now a control-plane blind spot. Security programmes built to inspect prompts and responses are already behind the operational reality of agentic systems. Once an agent can choose tools and sequence actions at runtime, the risk surface is defined by delegated authority, not by model text. Practitioners should treat action control as the primary governance layer.

MCP is not just an integration standard, it is an identity boundary. The protocol determines which tools an agent can reach, what context it can ingest, and how much trust it inherits from connected servers. That means MCP governance belongs with NHI and PAM controls, not only with application integration teams. Practitioners need to govern the server, the token, and the action path together.

Purpose-based access control is the right named concept for agentic systems. Static roles assume stable job functions, but agentic work is task-shaped and time-bounded. Purpose-based access control describes the need to authorise the declared task at runtime, then expire that authority when the task ends. Practitioners should use this lens when designing least-privilege policy for agents.

Delegated authority collapses accountability unless identity propagates through every hop. When one agent hands work to another, the original human or system intent can disappear unless the identity chain is preserved. That creates audit gaps that affect incident response, access review, and compliance evidence. Practitioners should require traceability across every agent-to-agent transition.

Agentic AI security now sits at the intersection of NHI governance and AI risk management. The controls that matter most are scoped credentials, runtime policy, immutable logging, and kill-switch logic, because those are the mechanisms that constrain delegated machine action. Practitioners should align identity, data, and AI governance around the same enforcement layer.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That gap points directly to the need for OWASP Agentic AI Top 10 style controls that cover runtime authority, tool misuse, and identity propagation.

What this signals

Purpose-based access control: agentic environments need task-scoped authority rather than static role assignment, because runtime intent changes faster than traditional IAM review cycles can absorb. That shift also makes MCP governance a shared concern for identity, data, and platform teams.

With 80% of organisations already reporting AI agents acting outside intended scope, the operational issue is no longer whether agents can drift, but whether the programme can detect and contain drift before it becomes a breach. The most useful control signal is not model accuracy, but whether every tool call is authorised, logged, and attributable.

The next governance gap will be between teams that can prove delegated identity across agent-to-agent hops and teams that can only show model output history. That distinction will matter for incident response, audit evidence, and policy enforcement across the full lifecycle of non-human identities.

For practitioners

• Inventory every agent and MCP connection Build a living inventory of agents, tool servers, inherited credentials, and data domains so shadow deployments and unmanaged tool paths are visible before enforcement starts.
• Scope credentials per tool call Replace broad, long-lived tokens with narrow, single-purpose credentials tied to one action and one tool, then revoke them as soon as the task boundary ends.
• Enforce runtime policy before execution Add a policy engine that evaluates each proposed tool call against current purpose, data sensitivity, and server trust before the action runs.
• Trace every delegation hop Log prompt, tool call, response, and downstream handoff with immutable provenance so accountability survives multi-agent chains and incident investigations.
• Define a tested kill switch Maintain an immediate stop mechanism that can suspend agent actions, block tool access, and freeze delegation paths when behaviour drifts outside policy.

Key takeaways

• Agentic AI changes the security problem from content inspection to runtime control of delegated machine actions.
• MCP expands the identity perimeter, so tokens, tool trust, and delegation tracing become core governance requirements.
• Programmes that cannot enforce purpose-scoped access and immutable audit trails will not be able to explain or contain agent-driven incidents.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Intent-Based Access Control: An access control model that evaluates not just what an agent is requesting, but the inferred intent and context behind the request — granting or denying access based on whether the action aligns with the agent's declared purpose.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.

What's in the full article

Trust3's full guide covers the operational detail this post intentionally leaves for the source:

• Step-by-step guidance for enforcing least privilege across agent tool calls and MCP servers
• Detailed logging and audit requirements for prompt, tool call, and agent-to-agent hops
• Operational examples of purpose-based access control and runtime policy enforcement
• Comparative discussion of governance layers for data, MCP, and delegated agent behaviour

👉 Trust3's full guide covers the runtime controls, logging expectations, and delegation safeguards in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.