TL;DR: AI security is really three problems, not one: defending against AI-powered threats, securing models and agents, and using AI to improve defensive operations, according to Anomali. That framing matters because agent permissions, auditability, and governance now sit alongside traditional detection and response, not outside them.
At a glance
What this is: Anomali frames AI security as three separate problems: threats that use AI, the AI systems being protected, and AI used in defence.
Why it matters: IAM, PAM, NHI and AI security teams need different controls, owners and evidence for each layer, especially where agents, pipelines and auditability intersect.
Context
AI security fails when teams collapse different risk types into one programme. The article separates AI-powered threats, the security of models and agents, and AI used in defensive operations, which is a more useful governance model than treating AI as a single control domain. Where agentic systems are involved, identity, permissions and audit trails become part of the control surface rather than a secondary concern.
The practical gap is organisational as much as technical: threat teams, model owners and operations teams often work to different success metrics, so controls drift across them. For identity and access practitioners, the key issue is that agent permissions and decision traceability must be governed alongside the broader AI system, or autonomy turns into unmanaged access and unreviewable action.
Key questions
Q: What breaks when AI security teams treat threats, models and operations as one problem?
A: Controls drift because the same programme tries to manage adversarial AI use, model governance and AI-assisted operations with one set of owners and metrics. That usually leaves gaps in accountability, auditability and access scope. A cleaner structure assigns different controls to each plane so teams can measure and govern the right risk at the right layer.
Q: Why do agent permissions create a different risk model from traditional application access?
A: Agent permissions can combine data access, tool execution and decision influence inside one runtime workflow. That makes the blast radius of a mistake or compromise much larger than a normal application account, because the agent can act across systems without a human in the loop. Governance has to focus on scope, approval and revocation at issuance time.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.
Q: When should organisations expand agentic AI beyond pilot use cases?
A: Only after the use case is bounded, the permissions are explicit and the audit layer can explain what happened in production. Expansion without those conditions turns experimentation into hidden operational risk. The practical test is whether the organisation can govern the agent as a controlled runtime actor, not just demonstrate a useful outcome.
Technical breakdown
Why AI security splits into three control planes
AI security is easiest to misunderstand when it is treated as one stack. The article’s three-plane framing separates external threat use of AI, the security of AI systems themselves, and AI as an operational aid for defenders. That distinction matters because each plane has different assets, trust assumptions and measures of success. Threats using AI demand detection and response speed. Securing the AI requires inventories, model governance, logging and access control. Using AI with security changes workflow design and outcome metrics, not just tooling choice.
Practical implication: Map controls to the correct plane before assigning ownership or measuring maturity.
How agent permissions change the AI risk model
Once agents are embedded in workflows, permissions stop being a side detail and become part of infrastructure risk. Agentic systems can act across data, tools and integrations, so access scope, approvals and auditability determine how far a compromise can travel. The article correctly links models, pipelines and agents with third-party and supply chain governance because those elements now influence what an AI system can do at runtime. In identity terms, this is where NHI governance meets AI governance: the agent is not just software, it is a privileged runtime actor.
Practical implication: Treat agent permissions as governed identities, not as application configuration.
Governance and auditability as a control boundary
The article’s strongest operational point is that governance is not a compliance overlay. In agentic environments, auditability is what makes the system reviewable, bounded and safely expandable. Without it, teams cannot explain model decisions, prove what an agent touched, or determine whether a workflow stayed within its intended scope. That is especially important where regulated data or operational change is involved, because the control objective is not just prevention. It is also reconstructability, so that security teams can understand what happened after the fact and whether the autonomy boundary held.
Practical implication: Build auditability into deployment design, not as a post-release logging add-on.
Threat narrative
Attacker objective: The objective is to overwhelm human-paced defence processes and create more opportunities for successful intrusion, deception or disruption.
- Entry begins when attackers use AI to accelerate social engineering and reconnaissance, increasing the volume and realism of initial contact.
- Escalation follows as AI-driven variants proliferate faster than human-only triage can absorb, compressing defender response time.
- Impact is achieved when defenders fall behind the machine-speed attack cycle and lose confidence in traditional manual bottlenecks.
Breaches seen in the wild
- Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI security is now three governance problems, not one. Security leaders who bundle threats, models and AI-assisted operations into a single programme obscure ownership and end up with mismatched controls. The article’s framework is useful because it forces different metrics for different risk planes. Practitioners should align threat detection, model governance and operational automation as separate workstreams with explicit handoffs.
Agent permissions are becoming a first-class identity issue. Once an AI system can call tools, access data and influence decisions, its permissions behave like a privileged NHI estate. That means inventory, authorisation scope, auditability and supply chain control matter as much as model quality. Teams that do not govern agent identity will struggle to explain who or what acted inside a workflow.
Auditability is the dividing line between automation and unmanaged autonomy. The article is right to connect AI deployment governance with traceable decisions and documented integrations. If an organisation cannot reconstruct what an agent did, then it cannot govern that agent, even if the model is technically accurate. Practitioners should treat auditability as an operational control, not a reporting feature.
AI governance debt: unreviewed AI deployments accumulate risk faster than teams can certify them. The article’s emphasis on qualification of use cases is important because uncontrolled experimentation creates hidden access paths, undocumented integrations and unclear ownership. Practitioners should measure how quickly governance catches up to deployment velocity, not just how fast teams can ship use cases.
From our research library:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
- Read next: Agentic AI Identity Maturity Model
What this signals
Agentic AI governance will increasingly be judged at issuance time, not after deployment. Access reviews assume permissions persist long enough to be certified. Agentic systems can request and discard privileges inside a single workflow, so the control must shift toward explicit approval, traceability and revocation before action.
69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That is a clear signal that identity, governance and AI operations are converging into the same operating model.
Qualification will become the real gating function for AI adoption. Teams that cannot prove a bounded use case, a documented owner and a reconstructable action trail will struggle to move from experimentation to safe production use. The governance question is no longer whether AI can be deployed, but whether it can be governed at the pace of deployment.
For practitioners
- Separate AI security ownership by control plane Assign distinct owners for AI-powered threat defence, AI system security and AI-enabled operations so the controls, evidence and success measures do not blur together.
- Inventory agents, integrations and decision paths Document every model, agent, pipeline, partner integration and third-party dependency that can affect AI behaviour or access scope.
- Treat agent permissions as governed identity Review what each agent can read, call and change, and bind those permissions to explicit approval, logging and revocation processes.
- Require auditability before broader rollout Make traceable decisions, retrievable logs and reconstruction of agent actions a release condition for production use cases.
- Use bounded use cases to sequence adoption Start with narrowly scoped workflows where autonomy is limited and business value is clear, then expand only after governance proves it can keep pace.
Key takeaways
- AI security splits into separate threat, model and operations problems, and each plane needs different controls and owners.
- Agent permissions turn AI systems into governed runtime actors, which makes identity and auditability central to safe deployment.
- Governance is the control boundary that separates useful automation from unmanaged autonomy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent permissions and runtime authority are central to the article's AI governance model. |
| Recommendation — Govern agent identities and privilege scope before allowing agents to execute tools or change workflows. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about governance structure, ownership and accountability for AI systems. |
| MANAGE — AI Risk Management | The article stresses operational controls for model inventories, auditability and bounded deployment. | |
| Recommendation — Define accountable AI governance roles, decision rights and evidence requirements for each deployment plane. Manage AI risk with inventories, traceability and release criteria tied to use-case qualification. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Access scope for agents and integrations is a direct control issue in the article. |
| Recommendation — Apply entitlement controls to agent workflows so permissions are explicit, bounded and reviewable. | ||
| MITRE ATLAS | TA0006;TA0008 — Credential Access; Lateral Movement | The threat framing includes faster AI-assisted attacks that compress defender response time. |
| Recommendation — Map AI-enabled attack acceleration to credential access and lateral movement techniques in detection content. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
- Agent Permissions: The access entitlements granted to an AI agent or other non-human system. In governance terms, these permissions matter because they define what the agent can read, change, or move, and therefore how quickly a normal workflow can become a material exposure.
- Auditability: Auditability is the ability to reconstruct who or what acted, what permissions were used, and what data or tools were touched. For AI and NHI governance, it is the minimum evidence needed to investigate incidents, validate controls, and prove that autonomous actions stayed within approved scope.
Deepen your knowledge
NHI Foundation Level course covers NHI governance, agentic AI identity and workload identity through the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity controls to broader security operations.
Published by the NHIMG editorial team on August 1, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org