The authorization gap is widening across NHI and agentic AI

At a glance

What this is: This is a technical analysis of the widening authorization gap, arguing that human-scale IAM controls no longer fit NHI and agentic AI environments.

Why it matters: It matters because practitioners now have to govern runtime decisions for workloads, service accounts, and agents, not just authenticate users and review entitlements periodically.

By the numbers:

• Non-human identities now outnumber human identities by a wide and accelerating margin, commonly cited industry figures range from 45:1 to 92:1 with a weighted enterprise average around 82:1.

Context

The problem is not that enterprises lack identity controls. The problem is that the dominant control model still assumes identity is established once, access is reviewed later, and authorization can be inferred from a stable role or entitlement set. That assumption breaks when the subject is a service account, workload, or AI agent making runtime decisions at machine speed.

In NHI governance terms, the gap is between authentication and decision-time authorization. For agentic AI, that gap widens further because tool use, data access, and downstream delegation can change inside a single task. The article frames this as a structural failure in the enterprise access model, not a tuning problem in one product or one policy layer.

Key questions

Q: What breaks when access is reviewed only on a schedule for NHIs and agents?

A: Scheduled reviews miss the moment when authorization is actually consumed. NHIs and agents can create, use, and discard access inside one task, so a quarterly or monthly review may only inspect stale entitlements. The result is governance that looks complete on paper while runtime decisions continue to drift outside intended scope.

Q: Why do static IAM roles create risk for agentic AI?

A: Static IAM roles create risk because they assume the identity's purpose is known in advance and will not change mid-session. Agentic AI can alter its behaviour, expand its scope, or chain into new tools during execution. That makes fixed permissions too broad and too blunt for safe governance.

Q: How do security teams know whether continuous authorisation is actually working?

A: Teams know it is working when sensitive actions are blocked or stepped up based on context, not just login state. Good signals include denials for unusual device or location combinations, policy decisions recorded for every high-risk action, and reduced trust in long-lived sessions. If every action still passes once the login succeeds, the control is not active enough.

Q: How should organisations centralise authorization decisions across cloud, mobile, and legacy applications?

A: Organisations should create a single policy decision point for authorization so access rules are applied consistently across applications and channels. The practical goal is to reduce ad hoc rules, improve governance, and make access decisions easier to audit. Policy-based control works best when business owners define policies, while identity and security teams enforce guardrails and oversight.

Technical breakdown

Why authentication is not authorization for NHIs

Authentication answers who or what a subject is. Authorization answers what that subject may do right now, against this resource, in this context, on whose behalf. The article’s core point is that enterprises have treated those as loosely linked for humans and then copied that model to NHIs, where the assumption fails. Service accounts, API keys, and agent tokens often authenticate successfully even when the action they request is out of scope, stale, or unsafe. Once policy is scattered across IdPs, cloud IAM, database rules, and application logic, there is no single runtime decision point that can enforce current context consistently.

Practical implication: move from entitlement-centric review to per-request authorization for non-human identities.

How agentic AI changes the authorization problem

Agentic systems do not follow a fixed sequence of calls. They select tools dynamically, react to intermediate results, and can make thousands of authorization-relevant decisions per minute. That turns every tool invocation into a policy decision, not just an application event. The article highlights prompt injection, confused deputy behavior, and over-permissioned tool registries as examples of what happens when the tool-call boundary lacks an enforcement layer. In this model, policy has to evaluate provenance, task context, and the requested action at runtime, because the model’s next step is not known in advance. The agent’s credentials authenticate the actor, but they do not define the safe scope of the session.

Practical implication: enforce policy at the tool-call boundary, not inside the model or only at provisioning time.

Why policy drift becomes a control failure

Policy drift is what happens when roles, ACLs, cloud permissions, and ad hoc application rules evolve independently. The article argues that this creates a control surface no human can reason over reliably, especially once NHI volume and agentic execution are added. A role in one system does not describe the full effective access of a subject whose permissions are spread across multiple stacks. That means quarterly reviews are measuring a snapshot of a moving target, not the operative authorization state. Continuous enforcement is the only way to keep policy aligned with live resource state, data sensitivity, and request provenance.

Practical implication: treat policy drift as an operational defect and measure live authorization state instead of stale entitlements.

Breaches seen in the wild

• Kubeflow cryptomining attacks 2020: Exposed Kubeflow dashboards and a notebook's mounted Kubernetes service account let attackers run cryptominers on tens of ML clusters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The authorization gap is a governance failure, not a tooling gap. Enterprises did not simply miss a feature. They built their access model around stable identities, infrequent decisions, and role-based inference, then applied it to systems that decide continuously. That mismatch is now visible across NHIs and agentic AI, where runtime behavior matters more than the credential itself. Practitioners need to treat authorization as a control plane, not an entitlement afterthought.

Runtime decisioning is the new security boundary: the old assumption that access can be reviewed after the fact was designed for human-paced activity. That assumption fails when NHIs and agents can create, combine, and consume permissions inside a single task or session. The implication is not just faster review cycles; it is a different operating model in which the decision point must sit in front of action.

Policy sprawl is now an availability and assurance problem. When authorization lives across IdPs, cloud IAM, databases, object stores, and microservices, no one system can answer who can do what. That fragmentation makes effective access both over-provisioned and hard to audit. The practical conclusion is that enterprises must collapse scattered rules into a coherent runtime policy model if they want reliable governance.

Agentic AI forces least privilege to become contextual, not static. The article shows that a token or role cannot capture what an agent will do next, because the next action depends on live prompts, retrieval results, and tool outputs. Least privilege therefore cannot stop at issuance time. Practitioners have to reframe privilege as a live decision problem tied to task provenance and current context.

Authorization will increasingly define the security posture of the AI-enabled enterprise. Authentication remains necessary, but it no longer differentiates a safe environment from an unsafe one when non-human subjects dominate execution. Enterprises that keep authorization as a downstream feature will keep producing over-permissioned behavior by design. The field is moving toward continuous, policy-driven enforcement as the baseline control expectation.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

Authorization has to move from entitlement review to runtime control. The article’s central signal is that the old sequence of authenticate, assign role, review later no longer matches how NHIs and agents operate. Practitioners should assume that access can now be created and consumed faster than any periodic governance cycle can see it, which makes live decisioning the only durable control model.

Policy sprawl will keep widening the gap unless decision logic is made coherent. When authorization is scattered across cloud IAM, databases, APIs, and application code, each system can be locally correct while the enterprise is globally unsafe. Teams should watch for inconsistent outcomes across systems as a sign that their authorization model has drifted from reality.

Authorization drift: this is the condition where policy, entitlements, and runtime behavior no longer describe the same effective access picture. In agentic and NHI-heavy environments, that drift becomes the operating risk, because the subject can act before governance catches up.

For practitioners

• Implement continuous authorization for non-human identities Evaluate each request against live context, including subject type, task state, resource sensitivity, and provenance, rather than relying on static entitlements or periodic reviews.
• Enforce policy at the tool-call boundary Place a decision point in front of every agent tool invocation so the system can permit, deny, or narrow access before an action executes.
• Map effective access across all policy surfaces Inventory where authority is actually expressed, including cloud IAM, database rules, application logic, and service permissions, then compare that to intended scope.
• Replace periodic reviews with runtime policy tests Use simulation, replay, and decision logging to verify that current policy still matches current workloads, agents, and data paths.

Key takeaways

• The article argues that the enterprise access model still assumes stable identities and infrequent decisions, which no longer fits NHI and agentic AI environments.
• Its evidence is structural rather than event-driven: the gap comes from policy spread across multiple systems and from runtime behavior that changes faster than review cycles.
• The practical fix is to govern authorization at decision time with live context, not to rely on static roles and delayed entitlement reviews.

Key terms

• Authorization Gap: The distance between what an authenticated identity can do and what it is actually permitted and proven to do in real time. For AI agents, the gap widens when decisions are made per action, at machine speed, and through workflows that expand faster than human review cycles.
• Continuous authorization: Continuous authorization is the practice of rechecking access as a session unfolds instead of trusting a single login decision. It matters for AI workflows because the request, context, retrieved data, and downstream action can all change between prompt and execution, making static approval too blunt.
• Policy decision point: A policy decision point evaluates contextual rules and returns an access decision that enforcement points can act on. It separates authorization logic from application code, which helps teams manage tenant rules, resource ownership, and risk signals consistently.
• Tool Call Boundary: The point at which model output is converted into a real system action, such as calling a function, querying a database, or invoking a shell. This boundary must be treated as an authorization checkpoint, because it turns text generation into operational authority.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.