Vendor-neutral control planes for AI agents expose Databricks limits

At a glance

What this is: This analysis argues that platform-native AI agent governance stops at vendor boundaries and cannot cover an enterprise’s full agent estate.

Why it matters: IAM and NHI teams need a control model that governs agent identity, purpose, and runtime access across platforms, not just inside one ecosystem.

👉 Read Trust3's analysis of Databricks-bound AI agent governance limits

Context

AI agent governance is the problem of controlling what software agents can see, decide, and do at runtime across the environments they operate in. The article’s central claim is that platform-native controls inside Databricks do not extend to agents running elsewhere, so enterprise governance remains fragmented.

That matters because the old IAM model relies on stable entitlements, central review cycles, and platform-bounded policy enforcement. Once agents operate across multiple clouds, SaaS systems, and internal APIs, governance has to follow the action rather than stop at the platform boundary.

This is the same structural problem that appears in non-human identity programmes whenever discovery, observation, and enforcement are split across silos. For teams already using OWASP Agentic AI Top 10, the article maps directly to the gap between model risk and runtime access control.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do native agent controls fail in multi-cloud environments?

A: Native controls are usually scoped to the platform that hosts the agent, so they cannot consistently govern identity, purpose, or tool use outside that boundary. Once agents operate across several clouds and SaaS systems, each local control plane becomes only partial coverage. The gap is not theoretical. It is an enterprise boundary problem.

Q: What breaks when agent access is not scoped to the task?

A: Standing privilege becomes the main failure mode. Without task scoping, an agent can reach systems, data, or actions that were never needed for the original request, increasing blast radius and audit difficulty. The same problem appears when revocation is slow, because the privilege outlives the work it was supposed to support.

Q: Who is accountable when an AI agent acts outside its intended scope?

A: The organisation is accountable, but operational responsibility should sit with a named owner and a governance process that can explain the agent’s purpose, access, and recorded actions. Without that, autonomous behaviour becomes unassignable risk rather than managed automation.

Technical breakdown

Why platform-native governance stops at the agent boundary

Platform-native governance can only enforce policy where the platform has direct control over identity, policy evaluation, and audit. That works inside a single ecosystem, such as one cloud or one agent framework, but it breaks when the enterprise runs agents across Databricks, Bedrock, Copilot Studio, CrewAI, and in-house systems. The problem is not visibility alone. It is that each platform tends to manage its own local policy plane, which leaves no consistent enterprise decision layer for identity, purpose, and action.

Practical implication: map where agent policy is enforced locally and identify where enterprise control disappears at the platform edge.

Discover, observe, secure: the three actions that make agent governance work

Agent governance needs three distinct functions. Discover finds the agents that exist in runtime traffic, registries, and logs. Observe records prompts, retrievals, and tool calls as they happen. Secure authorizes the live action with a just-in-time decision, writes an immutable audit record, and blocks or masks the call if policy fails. This is closer to inline identity enforcement than to reporting, because the control must fire at the moment of execution, not after the fact.

Practical implication: separate detection, telemetry, and enforcement in your operating model so you can prove which layer actually blocks non-compliant actions.

Why time-to-access is now an identity control for agents

The article is right to treat time-to-access as a first-class metric. Agents do not wait for tickets, and they should not retain privilege after the task ends. A standing entitlement outlives the work and turns a task-scoped identity into a reusable access path. That changes the governance problem from provisioning to revocation timing, because the risk sits in the duration of access as much as in the permission itself.

Practical implication: measure how long agent access remains active after task completion and treat excess dwell time as a governance failure.

Threat narrative

Attacker objective: The objective is to use fragmented governance to let an agent keep acting outside the controls that should have constrained its purpose and lifetime.

1. Entry begins when an enterprise agent is sanctioned inside one platform but also reaches external data and tools beyond that platform’s native governance boundary.
2. Escalation occurs when the agent’s granted purpose and task window are not enforced consistently across systems, allowing access to persist after the intended action is complete.
3. Impact follows when the agent can continue calling tools or retrieving data with no single audit trail or revocation path across the wider enterprise stack.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vendor-neutral agent governance is becoming the only workable enterprise model. Native controls can protect agents inside a single platform, but they do not solve multi-platform identity and access governance. Enterprises now run agents across cloud services, SaaS applications, and internal systems, so governance that stops at the vendor boundary is incomplete by design. The practical conclusion is that the control plane must be independent of the framework carrying the agent.

Access review assumptions break down when agent action is task-bounded, not tenure-bounded. Recertification models were built for access that persists long enough to be reviewed on a schedule. That assumption fails when an agent acquires privilege for a single task, uses it immediately, and should lose it as soon as the task ends. The implication is not just faster review, but a different governance premise for when access exists at all.

Time-to-access is a better metric than entitlement count for agent programmes. Counting agents or privileges does not reveal whether governance is working. What matters is how quickly access is granted, how narrowly purpose is scoped, and how fast it disappears after use. That is the operational difference between a governed agent and a continuously over-permissioned one.

Discover, observe, secure is the right control sequence for agent identity operations. Discovery without enforcement only inventories risk, while enforcement without discovery misses shadow AI. The article’s three-step model is structurally sound because it separates finding agents, recording behaviour, and making live decisions. Practitioners should treat that sequence as the minimum operating model for cross-platform AI agent governance.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, which helps explain why governance often lags engineering reality.
• For a broader identity perspective, the Ultimate Guide to NHIs , 2025 Outlook and Predictions helps frame how machine identity sprawl changes programme design.

What this signals

Vendor-neutral control becomes the governing concept for agentic programmes. Once agents operate across multiple clouds and frameworks, platform-native policy can only describe part of the estate. The enterprise needs a control model that is independent of any single agent runtime, and that means identity, purpose, and audit have to travel with the action, not the platform.

With our LLMjacking research showing how quickly exposed credentials are abused in AI-adjacent environments, the practical lesson is that runtime exposure windows matter more than static policy intent. That is especially true when agent access can be created and discarded inside one workflow.

The governance shift here is not just operational. It also aligns with broader identity lifecycle thinking, where discovery, entitlement scope, and revocation timing must be managed as a single control loop. Teams that still treat agent access as a static permission problem will miss the real failure mode: access that persists longer than the task it was meant to support.

For practitioners

• Define an enterprise agent control plane Map every platform where agents run, then decide which layer owns discovery, policy evaluation, and revocation across the full estate. Do not accept governance that ends at the first vendor boundary.
• Bind agent grants to task completion Issue access with an expiry tied to the task, not the account lifecycle, and revoke it the moment the declared work is complete. Track dwell time after task closure as a governance metric.
• Separate observation from authorization Capture prompts, retrievals, and tool calls for audit, but reserve the live decision for a control path that can block, mask, or approve in real time. Logging alone does not govern agent behaviour.
• Test revocation paths across frameworks Validate that a single non-compliant tool call can be blocked consistently in Databricks, Bedrock, Copilot Studio, CrewAI, and internal systems. If one framework cannot be stopped, the enterprise does not have unified governance.

Key takeaways

• AI agent governance fails when it stops at the vendor boundary, because enterprise agents rarely live in one ecosystem.
• Runtime discovery, live observation, and just-in-time authorization are the minimum controls needed to govern agents across platforms.
• Task-bound access duration is now an identity metric, because agent privilege that outlives the job becomes avoidable exposure.

Key terms

• Agent Control Plane: An agent control plane is the policy layer that decides what an AI agent may do before execution. It connects discovery, identity, and authorization so the organisation can enforce task-scoped limits instead of relying on static registration or after-the-fact review.
• Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.
• Vendor-neutral governance layer: A control layer that aggregates findings from multiple security tools without favouring one vendor's ecosystem. It normalises risk, prioritises remediation, and preserves auditability across heterogeneous environments, which becomes more important as detection gets embedded into platforms.

What's in the full article

Trust3's full analysis covers the operational detail this post intentionally leaves for the source:

• Platform-specific examples of how Unity AI Gateway governs Databricks agents and where that enforcement stops.
• The full discover, observe, secure workflow as implemented across agent registries, runtime traffic, and tool calls.
• Decision criteria for fail-static enforcement when a control plane is unreachable, including revocation paths and policy caching.
• The exact questions Trust3 says leaders should ask before approving vendor-neutral agent governance.

👉 Trust3's full post covers the cross-platform control model, task-bound access, and revocation implications in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.