TL;DR: Agentic AI systems are being wired into enterprise workflows, but most still lack the encryption, authentication, auditability, and revocation controls needed to trust them as workload identities, according to Keyfactor. The governance assumption that AI can act safely without durable identity and controlled access collapses once agents can connect to tools, data, and other systems at runtime.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Keyfactor's blog post: Machine identity, digital certificates, auditability, and rapid revocation are now required for AI systems that act across enterprise tools and data.
Why it matters: It matters because IAM, PAM, and NHI programmes must treat agentic AI as a workload identity problem, where authentication, access scope, logging, and offboarding determine whether autonomy can be trusted.
Context
Agentic AI changes the identity problem because the system does not just produce content, it initiates actions across tools, data sources, and applications. That means identity security now sits on the path between model output and enterprise execution, not just on the login screen.
Keyfactor’s article frames this through digital trust, machine identity, and MCP as the protocol layer that lets AI systems connect to enterprise software. The governance gap is straightforward: if the system can act, it must be authenticated, authorised, logged, and revocable like any other workload identity.
That shift is most visible in environments where connected devices and autonomous workflows already create operational risk. The article’s starting position is typical of the market: teams are wiring in agentic AI faster than they are extending identity controls to govern it.
Key questions
Q: What should organisations do when agentic AI starts using enterprise tools?
A: Organisations should define what the system may access, what actions require approval, and who is accountable if behaviour changes during execution. The key is to govern runtime authority, not just initial provisioning. Without that boundary, the AI workflow can expand its own operational reach faster than conventional IGA can observe it.
Q: When do secrets become a higher risk in agentic AI environments?
A: Risk rises when autonomous systems can copy, reuse, or trigger credentials across multiple tools and workflows. At that point, one exposed secret can support repeated machine execution rather than a single human action. Teams should assume faster exploitation and stronger amplification when AI agents are involved.
Q: What breaks when agent access cannot be revoked quickly?
A: When agent access cannot be revoked quickly, business errors can compound at machine speed across publishing, pricing, data updates, or customer interactions. The failure is not only operational. It also defeats governance, because a control that cannot be pulled back in time is not a real control.
Q: What is the difference between agentic AI controls and traditional workload identity controls?
A: Traditional workload identity controls usually assume a stable service with predictable behaviour. Agentic AI adds runtime decision-making, tool choice, and dynamic execution paths, so the control model has to account for changing intent, broader tool use, and more immediate containment when behaviour drifts.
Technical breakdown
Why agentic AI behaves like a workload identity
Agentic AI is not just a model that generates text. Once it can choose actions, call tools, and interact with enterprise systems, it behaves operationally like a workload identity that needs cryptographic trust. The article points to MCP as the interface that lets agents connect to apps and data, which makes the identity layer part of the runtime path. In practice, that means trust depends on proving what the agent is, what it is allowed to do, and whether the connection can be verified end to end.
Practical implication: treat agents as identities with explicit authentication and authorisation boundaries, not as generic software features.
Why shared secrets and SSH keys are the wrong trust model
The article argues for certificate-based identity instead of SSH keys or shared secrets because agentic systems need durable, verifiable trust that can be rotated and revoked. Shared secrets do not provide the same provenance, and they are poor fit for machine-to-machine execution where the agent may connect to multiple services, data stores, and other agents. Certificates also support a chain of trust, which matters when the system’s legitimacy has to be verified by multiple downstream services.
Practical implication: replace static secrets with certificate-backed machine identity wherever agents initiate enterprise connections.
Auditability and revocation are the governance controls that matter
For agentic AI, identity is only useful if the organisation can observe behaviour and cut access quickly when the agent drifts from expectation. The article’s four capabilities, strong identities, fine-grained access controls, auditability, and rapid access revocation, map to the operational reality of autonomous systems. Because agents can act continuously and at machine speed, review processes alone are not enough unless they are backed by logging and immediate offboarding paths.
Practical implication: design agent governance so that anomalous behaviour is detectable and access can be revoked without waiting for a manual review cycle.
NHI Mgmt Group analysis
Agentic AI is now an identity governance problem, not just an AI governance problem. Once an agent can initiate tool calls and connect to enterprise systems, it stops being a passive model output channel and becomes an identity-bearing runtime actor. That shifts the centre of gravity from prompt safety to access control, auditability, and offboarding. Practitioners should frame this as workload identity expansion, not as a narrow AI feature issue.
Digital trust becomes the missing control plane for autonomous execution. The article is right to emphasise certificates, authentication, and revocation because those are the controls that make machine action attributable and containable. Without them, agent activity blends into normal system traffic and governance loses the ability to distinguish authorised autonomy from abuse. The field should treat digital trust as the prerequisite for scaled agent deployment.
Strong identity is necessary, but it is not sufficient without narrow delegation. Agentic systems can fail safely only when identity is paired with constrained tool access, session-specific scope, and observable behaviour. If the system can acquire access and keep it broadly enough to be useful, it can also exceed the original trust boundary. Practitioners should assume that agent autonomy widens the blast radius unless delegation is tightly bounded.
Access review assumptions break when execution is machine-timed. Traditional governance assumes access persists long enough to be reviewed and certified. That assumption becomes fragile when an agent can connect, act, and detach as part of a dynamic runtime process. The implication is that identity review programmes need to shift emphasis toward issuance-time trust, runtime logging, and immediate revocation paths for autonomous systems.
MCP will matter because protocols shape governance reality. The article’s MCP discussion matters less as a product note and more as a reminder that protocol standardisation accelerates scale. Once a common interface exists for agent-to-tool interaction, identity controls must be implemented consistently across many systems rather than handled as one-off exceptions. Practitioners should expect protocol layers to drive the next wave of identity governance requirements.
From our research library:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Maturity Model
What this signals
Digital trust will become the practical boundary for agentic AI adoption. Organisations that cannot bind agent actions to verifiable identities will struggle to scale autonomy beyond pilots. The control question is no longer whether a model can act, but whether the identity system can prove and contain what it did.
Agentic AI changes the lifecycle question for machine identities. Provisioning is only the beginning. Offboarding, revocation, and monitoring need to be designed for systems that can chain tool use at runtime and leave a wider blast radius than a conventional workload.
67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey. That gap matters because static credentials undermine the very trust fabric agentic systems need to be governed safely.
For practitioners
- Map every agent to a named identity Inventory agentic systems as first-class workload identities, including their owners, intended actions, and connected tools. Do not leave agents hidden inside application teams or treat them as feature flags.
- Replace shared secrets with certificate-based trust Move agent connections away from SSH keys and shared secrets so the organisation can establish origin, authenticity, and revocation discipline for each runtime identity.
- Constrain each agent to narrow tool scopes Define the minimum set of applications, data stores, and actions each agent may use, then separate privileges by task rather than by platform.
- Build revocation into the operating model Ensure security teams can disable an agent’s access immediately when behaviour changes, without waiting for a monthly review or application release cycle.
- Log agent actions in a form detection tools can use Send agent identity, tool invocation, and access events into monitoring pipelines so SIEM workflows can flag anomalous behaviour across the connected estate.
Key takeaways
- Agentic AI becomes an identity problem once it can initiate actions across enterprise systems, because trust, authorisation, and revocation must follow the runtime path.
- Static secrets and weak authentication are a poor fit for agent-driven workflows because they do not provide durable provenance or fast containment.
- The practical control shift is toward certificate-backed trust, narrow delegation, auditability, and immediate offboarding when an agent’s behaviour changes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centers on how agent identities and privileges must be governed at runtime. |
| Recommendation — Apply ASI03 by binding each agent to narrow, revocable privileges and monitoring privilege drift. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article argues that agents must be authenticated before they can be trusted to connect. |
| NHI-05 — Overprivileged NHI | Agentic systems need fine-grained access controls to prevent broad runtime access. | |
| NHI-07 — Long-Lived Secrets | The article explicitly rejects shared secrets in favour of stronger identity controls. | |
| Recommendation — Use NHI-04 to replace weak authentication paths with verifiable machine identity. Apply NHI-05 to reduce agent permissions to the minimum required for each task. Use NHI-07 to phase out long-lived credentials in agent connectivity paths. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is about governing autonomous AI behaviour through identity and trust. |
| Recommendation — Establish GOVERN processes that assign ownership, accountability, and oversight for agentic AI. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
- Digital Trust: Digital trust is the set of cryptographic and identity controls that allow systems, users, and services to verify each other reliably. It includes PKI, federation, certificates, and authentication foundations that must remain adaptable as technologies and threat conditions change.
- MCP: Model Context Protocol, an open way for AI agents to connect to tools and data sources. It improves interoperability, but it also introduces a shared integration layer that must be governed carefully because the protocol can widen access across many systems at once.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org