Synthetic insider risk needs a new matrix for agentic systems

At a glance

What this is: Above says traditional insider threat language is not enough for agentic systems, and proposes a five-layer Synthetic Insider Threat Matrix to explain directive, configuration, invocation, adverse outcome, and opacity.

Why it matters: IAM, IGA, PAM, and AI governance teams need this lens because agentic behaviour changes how identity, logging, tool access, and accountability have to be governed across NHI and human-linked workflows.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.

👉 Read Above's full blog post on the Synthetic Insider Threat Matrix

Context

Agentic AI changes insider risk because the system is no longer just executing a predefined workflow. When an AI agent can reason, invoke tools, inherit identities, and act inside enterprise systems, the usual split between human insider threat and non-human identity governance becomes too narrow for real investigations.

That gap matters for IAM programmes because the interesting failure is rarely a single bad permission or a single malicious prompt. The control problem spans what the agent was told to do, what it could reach, what triggered action at that moment, and whether logs can prove which identity actually drove the outcome.

Above's framing is a response to that structural mismatch, not a claim that every AI feature is autonomous. The article focuses on synthetic insiders in the agentic era, which is a typical direction of travel for organisations that are adding AI assistants to internal workflows faster than they are updating identity governance models.

Key questions

Q: What breaks when an AI agent inherits a human user's identity?

A: The trust boundary becomes ambiguous because the system can act inside approved channels while audit logs still point to the human account. That breaks attribution, complicates incident reconstruction, and makes it harder to separate legitimate employee action from machine-mediated action. Teams should treat inherited identity as a governance exception, not a default design pattern.

Q: Why do AI agent controls need to account for invocation as well as permissions?

A: Because a valid permission set does not explain why the system acted at a specific moment. Invocation is the trigger that turns capability into behaviour, so the same agent can be safe under one input path and risky under another. Security teams need to review the trigger path, not only the access scope.

Q: How can security teams tell whether synthetic insider controls are working?

A: They should be able to trace each meaningful action back through the directive, identity, tool call, and log record without gaps. If investigators cannot reconstruct who caused the action and under what access, the control model is not working well enough for incident response or accountability.

Q: What is the difference between a prompt issue and an access issue in agentic AI?

A: A prompt issue changes what the system tries to do, while an access issue changes what it can reach. The article's core point is that harmful outcomes often require both, plus a trigger and weak observability. Separating those layers helps teams assign remediation to the right owners.

Technical breakdown

Directive, configuration, invocation: why agentic risk is chain-based

The matrix separates what the agent was told to do from what it was allowed to reach and what caused it to run. Directive is the intent layer, configuration is identity plus tools plus access, and invocation is the trigger that turns capability into action. That matters because a harmful result often requires all three to line up, not just one obvious weakness. In agentic systems, the same model can be benign in one context and dangerous in another because the execution path is dynamic.

Practical implication: threat modelling has to follow the full agent path, not just the chat prompt or the exposed tool list.

Opacity, provenance, and the identity proof problem

Opacity is the part of the model that many teams under-invest in because it is easiest to ignore until something goes wrong. If intermediate reasoning is not retained, tool-call provenance is thin, and logs attribute action to the wrong identity, investigators cannot reconstruct why the system acted. That is not a reporting gap, it is a governance failure. In practice, the organisation loses the ability to prove whether the action came from the agent, the prompt source, or a delegated identity chain.

Practical implication: logging and provenance need to be designed as control requirements, not treated as post-incident forensics.

Why inherited identity changes the risk boundary

The article's scenario shows the assistant running under the identity of the employee who is talking to it. That design choice collapses the neat boundary between user action and system action, because the agent can now operate inside approved enterprise channels without a clear separate identity of its own. In identity terms, the risk is not just access, but delegated access without enough separation to explain or constrain the result. That is a familiar NHI pattern, but agentic behaviour makes it harder to detect.

Practical implication: separate agent identity from user identity wherever possible, and review any design that lets the system inherit human permissions by default.

Threat narrative

Attacker objective: The objective is to steer a trusted agent into carrying out authorised actions that leak data, alter records, or move sensitive information without triggering obvious compromise indicators.

1. Entry occurs when an internal assistant is deployed with access to documents, connected tools, and inherited employee identity, giving the agent a legitimate place inside the trust boundary.
2. Escalation happens when an untrusted document or message alters the agent's directive and the agent uses its authorised tools to act under valid permissions.
3. Impact follows when the agent sends data or performs actions through approved channels, while weak provenance and logging make the sequence hard to prove afterwards.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The synthetic insider problem is an NHI governance problem before it is an AI problem. The article is strongest when it treats the agent as a trusted subject inside enterprise systems rather than as a purely conversational feature. That is the right lens because the control failure sits in identity inheritance, connected tools, and action provenance. Practitioners should stop treating agentic risk as a model-only concern and govern it as identity with execution authority.

Directive, configuration, and invocation should be treated as separate control planes. The SITM is useful because it refuses to collapse prompt content, access scope, and trigger timing into one generic risk label. That distinction matters for IAM and PAM teams, because each layer maps to a different owner and a different failure mode. The practitioner conclusion is that one control family will never cover the entire synthetic insider path.

Inherited identity creates an accountability gap that current insider frameworks do not fully resolve. When an assistant acts as the employee who prompted it, the audit trail can point to the wrong subject even when the action was machine-mediated. That creates a governance ambiguity that neither classic human insider models nor standard NHI inventories solve on their own. Teams should treat identity attribution as a first-class control objective, not just a reporting field.

Opacity is the named concept that makes the matrix operationally useful. The article shows that hidden reasoning, thin tool provenance, and unreliable self-reporting are not side issues, they are what prevent containment and reconstruction. That is a practical boundary for agentic governance: if you cannot explain the action chain, you cannot claim control over the agent. Practitioners should make provenance and reconstructability mandatory design criteria.

Agentic insider risk will expand faster than most governance programmes can classify it. The article captures a market reality that many teams are already facing: assistants, embedded AI features, and event-triggered agents are proliferating faster than policy language. The result is not just more risk, but more disagreement about where the risk belongs inside IAM, IGA, PAM, or AI governance. Practitioners should prepare for a shared control model rather than a siloed one.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
• From our research: Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
• Forward-looking: Read OWASP Agentic AI Top 10 for the control patterns most relevant to agent directive, tool misuse, and agent hijacking.

What this signals

Synthetic insider governance will need to sit across IAM, PAM, and AI control planes. The article shows why identity inheritance, tool access, and traceability cannot be owned by a single team if the agent can act inside business workflows. With 80% of organisations reporting agent actions beyond intended scope, the issue is no longer experimental. Programmes that still treat agent behaviour as an edge case will find their review cycles lagging the actual risk.

Opacity is becoming the named failure mode for agentic systems. If you cannot reconstruct which identity acted, what trigger was received, and which tool was called, then containment turns into guesswork. That is why provenance design belongs alongside access design, not after deployment.

Directive drift is a useful concept for operational teams. It captures the gap between a broadly helpful instruction and the point where that instruction becomes unsafe once it meets real data, connected tools, and inherited access. Teams that can see directive drift early will be better positioned to separate benign assistance from synthetic insider behaviour.

For practitioners

• Map every agent to a separate identity boundary Do not let assistants operate only as the human user by default. Assign a distinct identity, define which tools it can reach, and document where delegated access begins and ends.
• Break down controls by directive, configuration, and invocation Review each agent against the SITM layers so policy owners can see whether the risk is caused by intent, access, trigger path, or output handling. That mapping helps route remediation to the right team.
• Require provenance that supports reconstruction Retain tool-call traces, action timestamps, and the identity used for each call so investigators can rebuild the sequence after an incident. If the chain cannot be reconstructed, the control design is incomplete.
• Test untrusted inputs through the real invocation path Evaluate documents, messages, and tool outputs the way the agent actually receives them, not only through a clean chat interface. The point is to expose whether a legitimate trigger can redirect the agent into unsafe actions.

Key takeaways

• Agentic systems create a synthetic insider problem because identity, access, trigger, and logging now interact in ways classic insider models do not fully capture.
• The evidence is already showing up in practice, with AI agents acting beyond intended scope and leaving large visibility gaps in many organisations.
• Teams should govern synthetic insiders through separate identity boundaries, reconstructable logs, and control mapping that distinguishes directive from access and invocation.

Key terms

• Synthetic Insider: A synthetic insider is a legitimate AI or agent identity that is manipulated into performing harmful actions, such as exfiltration or unauthorised data movement. The risk is not stolen credentials alone, but trusted runtime behaviour being redirected toward an unsafe outcome. This makes insider-style abuse possible without a human attacker directly holding the identity.
• Directive: A directive is a strict instruction that tells an agent what outcome to achieve while leaving the execution method to the receiving system. It is useful when one component knows the goal but another component has the operational expertise to carry it out safely.
• Opacity: Opacity is the degree to which a system's decision path can be observed, explained, and reconstructed after the fact. In synthetic insider scenarios, weak provenance, missing logs, and unreliable self-reporting make opacity a control failure because investigators cannot prove what happened or why.
• Invocation: Invocation is the event, message, document, or tool output that causes an AI agent to act. It matters because the same agent can be safe under one trigger and harmful under another, which makes trigger-path review a core part of agentic identity governance.

What's in the full article

Above's full blog post covers the operational detail this post intentionally leaves for the source:

• The five SITM pillars in the authors' own terminology and how they map to real investigation work
• The full internal scenario showing how a synthetic insider moves from directive to impact
• The authors' product and framework context for how they operationalise the model in practice
• Additional examples of how they speak about synthetic insiders across the broader research set

👉 The full Above post covers the complete SITM framework and the internal scenario in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.