Why agentic AI breaks people-first IAM assumptions

At a glance

What this is: This is a commentary on why people-first IAM assumptions fail when applied to AI agents and other non-human identities.

Why it matters: It matters because IAM, PAM, and governance teams must distinguish human, NHI, and autonomous behaviour before access reviews, policy enforcement, and audit trails can be trusted.

By the numbers:

• Machine identities outnumber human ones by anywhere from 80 to 1 to more than 100 to 1 in the modern enterprise.
• Only 18% expressing high confidence that their existing identity systems can effectively manage agent identities.
• 71% of enterprises experienced an identity-related breach in 2025.
• 43% of organizations use shared service accounts for their AI agents.

👉 Read Pomerium's analysis of why IAM built for people fails for AI agents

Context

Primary keyword: agentic AI identity. The problem is not that organisations lack authentication controls, but that those controls were designed around a person with a predictable session, a manager-approved role, and a stable offboarding path. When the subject is an AI agent, that model breaks because runtime decisions, tool selection, and delegation can all change inside a single task.

Pomerium’s argument is that identity must become the enforcement layer for AI agent access, with per-request policy, short-lived credentials, and auditable identity context attached to every hop. That aligns with the broader NHI governance problem: if the actor is not human, then the old assumptions behind IAM, PAM, and access review no longer hold in their original form.

For teams building or reviewing machine identity controls, the useful reference point is the Ultimate Guide to NHIs, which frames governance, lifecycle, visibility, rotation, offboarding, and Zero Trust across service accounts, tokens, and workload identities.

Key questions

Q: How should security teams govern AI agents that can change actions at runtime?

A: Security teams should govern runtime AI by correlating identity, data, and intent before trusting an action path. If the system can select tools or alter its sequence mid-session, a static access policy is not enough. The control objective becomes contextual verification of what the agent is doing, why it is doing it, and whether the data touched matches the approved purpose.

Q: Why do AI agents break traditional IAM assumptions?

A: AI agents break IAM assumptions because they do not behave like predictable users. They can authenticate to multiple systems, select tools dynamically, and execute tasks at machine speed without a human approval gate between actions. That removes the stable login session that traditional IAM uses as its trust anchor.

Q: What do security teams get wrong about non-human identity governance?

A: They often treat service accounts and tokens as static technical assets instead of governed identities with owners, lifecycle events, and offboarding requirements. That mistake leaves visibility gaps, stale access, and unknown third-party exposure in place long after the original business need has changed.

Q: Who is accountable when an AI agent uses delegated access incorrectly?

A: Accountability should follow the delegated authority chain, not stop at the agent label. The relevant owners are the teams responsible for the human identity, the service identity, the workflow, and the policy that allowed the action path. If those responsibilities are not explicit, incident review will be incomplete and remediation will focus on the wrong layer.

Technical breakdown

Why human-speed sessions fail for AI agent identity

Legacy IAM assumes a session is created for a person, then remains broadly trustworthy until expiry. That assumption is workable for a user browsing apps or completing a human-paced workflow. It fails when an agent generates high-frequency API traffic, spawns sub-agents, and changes its own execution path in response to new prompts or data. The technical issue is not volume alone. It is that the identity can shift scope faster than human-based anomaly detection, quarterly recertification, or role review can observe.

Practical implication: treat session lifetime and review cadence as control boundaries that may be too slow for agentic workloads.

Why runtime delegation breaks static RBAC for agentic AI identity

Role-based access control works when access can be mapped in advance to a stable job function. Agentic systems do not stay stable long enough for that model to remain complete, because they may request new permissions during execution or delegate work to sub-agents. That creates scope drift inside a single task. In practice, least privilege is no longer just a provisioning problem. It becomes a runtime authorisation problem, because the relevant permission set may not be knowable before the task begins.

Practical implication: separate entitlement design from runtime enforcement, or the agent will accumulate access faster than governance can certify it.

How identity-aware proxies change non-human identity enforcement

An identity-aware proxy moves authorisation out of the agent and into infrastructure that evaluates each request independently. That matters because an agent cannot be trusted to police its own restrictions once compromised or redirected by untrusted input. Short-lived tokens, per-request policy checks, and immutable logging reduce the value of stolen credentials and preserve attribution across service hops. This is the same zero trust principle applied to machine identity, but executed at machine speed rather than human interaction speed.

Practical implication: put policy enforcement in front of the workload, not inside the agent or the application it controls.

Threat narrative

Attacker objective: The objective is to use legitimate agent authority to reach systems and data that should have remained outside the delegated scope.

1. Entry occurs when an attacker or malicious prompt obtains access to an agent's session or credentials, often through exposed tokens or permissive delegation paths.
2. Escalation follows when the agent expands its own scope, invokes more tools, or chains requests across services faster than human review can intervene.
3. Impact is realised when the agent acts with borrowed authority across systems, creating unauthorised data access, lateral movement, or compliance failure.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

People-first IAM is the wrong operating model once the subject is an agent. Human identity programmes assume a person, a manager, and a session that lasts long enough to review. That assumption is structurally mismatched to agentic AI identity, where runtime decisions and delegation can change faster than governance can observe. The implication is that identity governance must stop treating all principals as if they behave like employees.

Identity review cadences are built on a timing assumption that autonomous behaviour breaks. Quarterly access review, recertification, and ticket-based approval all presume access remains stable long enough to be evaluated. When an agent acquires and releases authority inside one workflow, there may be no durable entitlement state left to certify. Practitioners need to recognise that the problem is not incomplete review, but a review model that cannot see the actor in time.

Runtime scope drift is the defining governance concept for agentic AI identity. The most important risk is not just that an agent has credentials, but that its authority expands as it chains tools, prompts, and delegated tasks. That makes traditional least privilege incomplete unless enforcement happens per request and outside the actor itself. Governance teams should treat scope drift as a design constraint, not an exception case.

Shared identity patterns are now a cross-domain failure mode across humans, NHIs, and agents. A shared service account, a shared token, or a shared human role all weaken accountability, but the damage is worse when the actor can change behaviour at runtime. That is why identity lifecycle, PAM governance, and NHI controls must be aligned rather than managed in separate silos. Practitioners should consolidate accountability around the actual actor, not the convenience of the access mechanism.

From our research:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
• From our research: Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• That visibility gap is why the 52 NHI Breaches Analysis remains a useful companion for understanding how exposed identities become incident paths.

What this signals

Runtime scope drift will become the operational test for agentic AI identity programmes. If a control only works when the actor behaves like a person, it will fail as soon as the agent can change tools, timing, or delegation without asking first.

With 97% of NHIs carrying excessive privileges, according to Ultimate Guide to NHIs, the governance problem is already familiar. The difference now is that AI agents can amplify that privilege debt at runtime, which means control design must move closer to the request path.

Teams should expect identity architecture to converge across human IAM, NHI governance, and autonomous access control. The practical shift is toward one accountability model that can handle human users, service accounts, and AI agents without assuming any of them behave the same way.

For practitioners

• Map where human IAM assumptions no longer fit Identify workflows where the actor is an AI agent or other non-human identity, then mark every control that assumes a manager-approved role, a stable session, or human-paced approval.
• Move authorisation to the request layer Place policy enforcement in an identity-aware proxy or equivalent control that checks every request outside the agent, so the actor cannot self-authorise once delegated scope begins to drift.
• Eliminate shared machine credentials Replace shared service accounts and long-lived API keys with distinct identities and short-lived credentials for each workload or agent, so accountability does not collapse across multiple actors.
• Rework access review for runtime behaviour Change recertification and offboarding processes so they look for delegation paths, scope changes, and token persistence, not just named owners and static entitlements.
• Instrument immutable audit context Log identity, request, and tool-use context in infrastructure the agent cannot edit, then retain that evidence for investigations and compliance reviews.

Key takeaways

• Agentic AI breaks IAM assumptions that were built for people, not runtime decision-making systems.
• The governance gap is not just missing controls. It is the mismatch between static review models and dynamic machine behaviour.
• Practitioners need request-time enforcement, distinct identities, and immutable audit context to keep accountability intact.

Key terms

• Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent — covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
• Runtime Scope Drift: Runtime scope drift is the condition where an agent's effective authority expands or changes during execution, beyond the access originally intended by the organisation. In practice, it appears when an agent chains tools, reuses permissions, or crosses workflow boundaries in ways that static reviews did not anticipate.
• Identity-aware Proxy: An identity-aware proxy combines routing with authentication and authorization logic. It checks tokens or certificates, applies policy at the edge, and forwards verified identity context to the backend so applications do not have to re-implement security decisions inconsistently.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.

What's in the full article

Pomerium's full blog post covers the operational detail this post intentionally leaves for the source:

• How its identity-aware proxy enforces per-request policy for agent workloads in front of applications and services
• How short-lived credentials and identity propagation are handled across multi-hop service calls
• How the infrastructure-level audit log preserves attribution for agent actions without relying on the agent itself
• How the zero trust pattern is applied to autonomous AI without reworking the workload architecture

👉 Pomerium's full blog post covers the identity-first enforcement pattern and audit model in more implementation detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or lifecycle governance, it is worth exploring.