Three control planes for AI agents fail when they do not agree

At a glance

What this is: This analysis explains why three separate AI agent control planes can all approve a session and still allow harmful outcomes when they do not share identity, telemetry, and authorization state.

Why it matters: It matters because IAM, PAM, and NHI teams now need to govern agent runtime decisions as a single access path, not as disconnected security checks spread across products.

Context

AI agent governance breaks when content inspection, tool brokering, and runtime authorization operate as separate decision paths rather than one control loop. In that model, each gateway can be correct in isolation while the combined session still exceeds the intended access boundary.

For identity teams, the issue is not only whether an agent is authenticated or whether a tool is sanctioned. The deeper problem is whether identity context, delegation chain, and policy state remain consistent across the full action sequence. When they do not, review and enforcement become retrospective only.

This is a design problem for agentic AI identity, not just a logging problem or a product-integration problem. The article’s central warning is that separate control planes create gaps where scope drift can happen without any one layer seeing the whole path.

Key questions

Q: What breaks when AI control planes do not share identity and policy state?

A: They can each approve their own slice of the session while the combined result becomes unsafe. The practical failure is scope drift across the agent path, where a clean prompt, legitimate tool connection, and valid authorization decision still produce an over-privileged outcome because no layer compares the full chain.

Q: Why do separate agent gateways increase risk in multi-hop delegation chains?

A: Because each hop can reissue or widen authority unless scope is intersected at issuance and lineage remains visible. The more products and integration boundaries involved, the easier it is for context to disappear and for the final privileged action to exceed the original principal’s intent.

Q: What are the signs that an AI agent control fabric is not coherent?

A: Different identity shapes across products, delayed policy updates after tool changes, and dashboards used to reconcile security decisions are strong warning signs. If the next request is not evaluated against the latest detection and authorization state, the fabric is already blind to part of the session.

Q: How should teams govern agentic AI when the model can act across multiple tools and services?

A: Teams should govern the full execution path, not just the model endpoint. The practical control is a replayable event history that records tool calls, context updates, and decisions in order, so security and compliance can reconstruct what happened. Without that trace, incident response and audit become guesswork.

Technical breakdown

Why separate AI control planes create blind spots

The article describes three distinct planes: an LLM gateway for prompts and completions, an MCP gateway for tool connections, and an agent gateway for privileged actions. Each plane sees only its own slice of the session, so the system can approve content, approve a tool, and approve an action without any layer understanding the full delegation chain. That is not a failure of any single control. It is a failure of shared state across controls. In practice, the risk appears when a technically valid request becomes unsafe only after the three approvals are combined.

Practical implication: treat the combined agent path as the governed object, not each gateway in isolation.

Identity reconciliation across the agent path

A canonical identity is only useful if every control plane resolves the same agent, the same parent principal, and the same hop in the delegation chain. If one product normalises identity differently, or if freshness and scope are evaluated at different times, the result is stale authority in one plane and current authority in another. The article shows that a byte-for-byte consistent identity view is a control requirement, not an implementation detail. Without it, policy decisions diverge even when the underlying intent has not changed.

Practical implication: enforce one canonical agent identity and one delegation graph across all policy decisions.

Scope intersection and queryable lineage

The hard technical edge is multi-hop delegation. When an orchestrator agent delegates to a sub-agent and that sub-agent invokes a privileged API, each hop can widen the effective scope unless the issuer enforces scope intersection at issuance time. If that intersection is only checked later, the chain can drift beyond what the original principal intended. Queryable lineage then becomes essential, because teams need to reconstruct who granted what, at which hop, and under which policy state. The article’s logic is that without lineage and issuer-side scope intersection, the chain is operationally opaque.

Practical implication: require issuer-side scope intersection and full delegation lineage for every agent token hop.

Threat narrative

Attacker objective: The objective is to turn individually approved agent activity into unauthorized data exposure by exploiting mismatched control-plane state.

1. Entry occurs when an agent authenticates cleanly and begins a normal session with no obvious malicious prompt content.
2. Escalation follows when the agent legitimately connects to a tool and the delegation chain expands across multiple control decisions that never reconcile state.
3. Impact occurs when the combined approvals allow compensation data to be exfiltrated even though no single plane saw an invalid request.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Three control planes that do not share state create an identity governance failure, not just a tooling gap. The article’s architecture problem is that prompt inspection, tool brokering, and runtime authorization can all be locally correct while still producing a globally wrong decision. That means the real unit of governance is the agent session and its delegation chain, not the individual gateway. Practitioners should judge the fabric by shared identity state, not by isolated product checks.

Canonical agent identity is the minimum viable control surface for agentic AI governance. When the same agent resolves differently across planes, policy becomes inconsistent by design. That is why identity reconciliation is not a back-office integration issue but a primary security boundary. The implication is that AI agent programs need a single authoritative identity context before they can claim coherent access control.

Scope drift is the named concept this article makes visible. Scope drift occurs when valid steps accumulate into an over-privileged outcome that no one plane intended. In agentic systems, this is not hypothetical because each hop can preserve technical correctness while changing effective authority. Practitioners should think in terms of accumulated authority, not just request-level authorization.

Mission-scoped revocation and queryable lineage are becoming baseline expectations for AI agent governance. If a stack cannot revoke an entire delegation tree or reconstruct the full chain after the fact, it cannot support defensible control over autonomous-leaning workflows. That shifts the market away from isolated security points and toward fabric-level governance. The implication for practitioners is to assess whether the platform can explain and unwind the whole path, not merely observe it.

AI agent security is converging on a control-path architecture question that crosses NHI, IAM, and PAM. The three planes map to content risk, tool identity, and privileged action authorization, so fragmented ownership guarantees blind spots. That is why the most useful operating model is a shared decision path with consistent policy state across all three layers. Practitioners should align ownership around the full agent path, not around product silos.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Identity Guide

What this signals

Scope drift is the governance failure that appears when three accurate controls never compare notes. A prompt filter, tool broker, and authorization engine can all operate correctly and still miss the cumulative effect of a delegation chain. For AI agent programmes, that means the control objective shifts from isolated approval to shared state at the moment of decision.

The governance test is whether your agent path can surface one canonical identity, one lineage record, and one revocation action across the whole session. If those three elements live in different products, the programme is managing fragments of authority rather than authority itself. That is where auditability breaks first.

For practitioners

• Audit for shared decision paths Map whether your content, tool, and authorization checks consume the same agent identity, delegation chain, and session state at the same moment.
• Enforce issuer-side scope intersection Require each delegation hop to receive only the intersection of requested scope, parent scope, and local policy before the token is issued.
• Validate lineage queryability Test whether you can reconstruct the full chain that produced a privileged action without stitching together four separate log sources after the fact.
• Set mission-scoped revocation as a control requirement Verify that one revocation action can terminate the entire delegation tree when an over-permissioned agent path is detected.
• Measure time-to-deny after tool delisting When a sanctioned tool is removed, check whether the authorization plane denies the next request immediately or only after a sync cycle.

Key takeaways

• AI agent control planes fail when local correctness hides global inconsistency across identity, detection, and policy state.
• The most important failure mode is scope drift, where valid hops accumulate into authority that no single plane intended.
• Practitioners should verify canonical identity, issuer-side scope intersection, and queryable lineage across the entire agent path.

Key terms

• Agent Control Path: The full sequence of checks that decides what an AI agent may do, including identity resolution, tool brokering, and runtime authorization. In agentic systems, the control path must behave as one coherent policy surface rather than three separate checks that can disagree.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
• Canonical Identity: A single, authoritative identity representation used consistently across systems to avoid conflicting views of the same actor. For AI agents, canonical identity should include the agent, its parent principal, and the current delegation state so policy decisions stay aligned.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.