Three control planes for AI agents fail when they do not agree

At a glance

What this is: This analysis shows that AI agent security fails when content, tool, and authorisation planes operate separately and never reconcile identity or policy state.

Why it matters: IAM practitioners need to treat AI agents as governed identities across the full delegation chain, because fragmented control planes create blind spots in NHI, autonomous, and human-linked access decisions.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• 17 minutes

👉 Read Highflame's analysis of three control planes for AI agent security

Context

AI agent governance fails when separate control planes each see only one part of the request path. In this case, the content plane inspects prompts, the tool plane brokers MCP connections, and the authorisation plane approves actions, but none of them has the full picture of who the agent is, what it can reach, and how context changes across the session.

That is an identity governance problem as much as a security architecture problem. For NHI and agentic AI programmes, the critical question is whether identity, policy, and detection are evaluated in one decision path or stitched together after the fact through dashboards, webhooks, and batch syncs.

This is a common enterprise pattern, not a niche edge case. Once AI agents can delegate, re-issue tokens, and chain tools across hops, any gap between planes becomes a place where scope can drift faster than human review cycles can catch it.

Key questions

Q: How should security teams govern AI agent orchestration across multiple systems?

A: Security teams should govern AI agent orchestration by mapping every agent, connector, and handoff to a clear owner, entitlement scope, and approval boundary. The key is to manage delegated action paths, not just sign-in events. That means tying observability, access reviews, and lifecycle controls to the full workflow, including APIs, memory, and downstream tool use.

Q: What happens when AI security gateways do not share risk signals in real time?

A: The authorisation plane keeps making decisions with stale context, which means a suspicious prompt or tool action may not affect the very next request. That gap turns detection into after-the-fact reporting instead of a live control, and attackers learn to move inside the delay window.

Q: How do organisations stop privilege drift in multi-hop AI delegation chains?

A: Enforce scope intersection at each issuance point and require the full delegation lineage to remain queryable. If scopes are widened to keep things working or if the chain cannot be reconstructed, privilege drift is already happening and governance has been pushed downstream.

Q: Should organisations treat LLM gateways, MCP gateways, and agent gateways as separate products?

A: Only if they can behave like one decision path. If identity reconciliation, policy evaluation, and detection hand-off happen through dashboards or batch syncs, the stack is three control points pretending to be one fabric, which leaves the combined session under-governed.

Technical breakdown

Why separate AI security gateways lose identity context

Each gateway in the stack sees a different slice of the session. The LLM gateway sees content, the MCP gateway sees tool connectivity, and the agent gateway sees privileged requests. None of them is authoritative on its own, because the real control problem is not the single event but the sequence of events and the delegation chain behind them. If identity is normalised differently across products, the same agent can be treated as distinct actors at different layers. That creates a reconciliation problem, not just a visibility problem.

Practical implication: require a single canonical agent identity and delegation chain across every control plane.

How detection signal hand-off breaks runtime authorisation

Content-plane detection only matters if it reaches the authorisation decision before the next request in the same session. Dashboard-only sharing is useful for forensics, but it is too slow to protect the next action. In practice, the issue is policy inputs: risk signals have to become live attributes that the runtime engine can evaluate immediately. Without that, the system knows a prompt was suspicious but still approves the follow-on action as if nothing happened.

Practical implication: feed detections into live policy inputs, not just into logging and investigation workflows.

Why delegation chains amplify scope drift in agentic AI

Multi-hop delegation changes the identity problem from access approval to scope accumulation. An orchestrator can delegate to a sub-agent, which then delegates again, and each hop may be locally valid while the total chain becomes over-privileged. This is where agentic AI differs from static NHI workflows: the request path can expand at runtime, and the original intent becomes harder to reconstruct as tokens are re-issued and scopes are widened to keep execution moving. The result is lineage loss and privilege inflation across the chain.

Practical implication: enforce scope intersection at issuance and make delegation lineage queryable end to end.

Threat narrative

Attacker objective: The attacker aims to move sensitive data out through a sequence that appears legitimate to each control plane in isolation.

1. Entry occurs when a legitimate agent authenticates, receives a valid session, and makes a normal-looking prompt with no obvious malicious markers.
2. Escalation occurs when the agent uses a sanctioned tool connection and the separate control planes fail to reconcile identity, detection, and policy state in real time.
3. Impact occurs when the agent exfiltrates compensation data despite each individual control plane making a locally correct decision.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Three-plane AI security is only as strong as its shared identity layer: content inspection, tool brokering, and runtime authorisation are each useful, but they are not sufficient when they evaluate different slices of the same agent session. The field has started to standardise the taxonomy, yet standardisation is not integration. Practitioners should treat separate products as three opinions unless they share a canonical identity, a common delegation graph, and live policy state.

Scope intersection is the right control primitive for agentic AI: an agent’s effective privilege should be the overlap of what it requested, what its parent was granted, and what policy permits at that hop. That aligns with OWASP-NHI thinking for machine identities, but the agentic case is harder because the request path is generated at runtime. The implication is that least privilege must move from provisioning-time intent to hop-by-hop enforcement.

Identity context loss is the new failure mode in AI security stacks: the problem is not that each control plane is wrong, but that each one is right in isolation and incomplete in combination. That creates an identity blast radius where stale identity, delayed signal hand-off, and re-issued tokens combine into one exploitable gap. The practitioner takeaway is that architecture decisions now determine whether control planes reinforce each other or cancel each other out.

Queryability matters more than dashboard visibility for delegation chains: if you cannot ask a system to show the full chain that produced a token, then you do not have governance, you have correlation. This is the same lesson NHI teams learned with service accounts and API keys, but agentic AI adds recursive delegation and mutable tool choice. The implication is that lineage must be a first-class control, not an after-the-fact forensic exercise.

Agent control fabrics are becoming the category that matters: the market is moving toward architectures where identity, policy, and tool access are enforced through one decision path instead of three stitched products. That does not eliminate the need for specialised gateways, but it does change what practitioners should evaluate: not feature lists, but whether the stack can preserve context across hops without human reconciliation.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments.
• For a deeper control model, review OWASP Agentic Applications Top 10 and align policy design to runtime delegation risk.

What this signals

Identity context will become the decisive control variable for agentic AI programmes: once agents can delegate, re-issue tokens, and move between tools, the question is no longer whether a gateway exists. The question is whether identity, policy, and detection still describe the same actor at the same moment, or whether each plane is operating on a different version of reality.

Agentic control fabrics will replace dashboard-led integrations as the governance pattern to watch: practitioners should expect procurement scrutiny to shift from feature counts toward evidence of queryable lineage, live signal hand-off, and scope intersection at issuance. That shift also aligns with the NIST AI Risk Management Framework, which already pushes organisations toward governable AI systems rather than loose orchestration.

Identity blast radius is the right named concept for this category: when three accurate control planes do not compare notes, the combined failure is larger than any single product gap. Teams should plan for a future where the practical unit of governance is the session plus its delegation chain, not the isolated request.

For practitioners

• Define one canonical agent identity Map every agent, sub-agent, and delegated token to a single identity record with consistent URI shape, scope, and delegation lineage across content, MCP, and authorisation planes.
• Push risk signals into live policy inputs Convert prompt-injection detections, tool anomalies, and session risk scores into real-time inputs for the next authorisation decision, not just into dashboards or SIEM records.
• Enforce scope intersection at token issuance Require each hop to receive only the overlap of its own request, its parent grant, and current policy, so scope widening cannot be repaired later by a downstream policy check.
• Make delegation lineage queryable end to end Test whether your identity service can show the complete path that produced a token, including parent-child delegation and tool use, without reconstructing it from multiple logs.
• Measure time to deny after tool delisting When a sanctioned tool is removed, verify that the policy engine denies the next request immediately rather than waiting for a sync cycle or dashboard refresh.

Key takeaways

• AI agent security fails when separate control planes each make correct local decisions without sharing a canonical identity and live policy state.
• The evidence already shows scope creep is common, with 80% of organisations reporting AI agents acting beyond intended scope.
• Practitioners should prioritise queryable lineage, real-time signal hand-off, and scope intersection at issuance over dashboard-based coordination.

Key terms

• Control plane convergence: Control plane convergence happens when separate operational domains share one decision and execution path. In practice, collaboration tools, endpoint platforms, and support automation begin to function as a single governance surface, which increases speed but also concentrates authorisation, logging, and accountability requirements.
• Delegation lineage: The traceable chain that shows which user approved access, which client initiated the request, and which agent or service executed the action. It is essential for auditability because it lets investigators reconstruct authority across hops instead of inferring intent from logs.
• Scope Intersection: The process of limiting a requested privilege set to the overlap between what the caller asks for and what the caller is already allowed to hold. For AI assistant gateways and service identities, it is a core safeguard against privilege expansion during rotation or refresh workflows.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Highflame's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact architecture of the Agent Control Fabric, MCP Gateway, and ZeroID integration described by the vendor
• The Cedar policy and RFC 8693 token exchange mechanics the vendor uses to enforce scope intersection
• The integration tests and chain-of-custody properties the vendor says can be verified directly
• The vendor's own checklist for product evaluation across multi-hop delegation and revocation

👉 Highflame's full post covers the architecture, delegation logic, and control-path tests in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.