Why just-in-time access fails for AI agent identities

At a glance

What this is: Clutch Security argues that just-in-time access breaks down for AI agent identities because the control depends on human-style intent, review, and accountability that agents do not provide.

Why it matters: IAM and NHI teams need to treat agent access as an identity governance problem, because timing a credential does not replace lineage, ownership, or enforceable behavioural boundaries.

Context

Just-in-time access is a time-bound access control pattern, but the article argues that the pattern depends on a human request model that AI agents do not satisfy. For agentic access, the core issue is not whether a credential expires, but whether the system can trust the declared intent that triggered the grant.

Clutch Security frames the governance gap as a mismatch between how JIT approval flows were designed and how AI agents operate at runtime. Agents can generate requests continuously, branch through tools and sub-agents, and alter their apparent intent inside the same task, which makes sentence-based authorisation brittle.

That means the identity problem sits above the timing problem. For IAM, IGA, and NHI programmes, the relevant question is no longer how to shorten access windows, but how to govern the identity, lineage, and ownership of the actor that is asking for access in the first place.

Key questions

Q: What breaks when just-in-time access is used for AI agents?

A: It breaks because JIT assumes a human request that is deliberate, reviewable, and accountable. AI agents can generate requests continuously, and attackers can influence those requests through prompt injection. The result is a control that may grant access correctly but still authorise attacker-shaped intent. The problem is not timing alone, it is trust in the request itself.

Q: Why do AI agents make excessive access more dangerous than human access?

A: AI agents can use inherited permissions continuously, across multiple systems, and at machine speed. That means a single overbroad entitlement can create rapid exposure to data, workflows, or administrative actions before humans notice. The risk is driven by both breadth of access and the pace at which the agent can exercise it.

Q: How do security teams know if an AI agent has too much access?

A: Look for agents that can reach multiple systems without task-specific limits, use persistent tokens, or touch high-value services such as email, chat, cloud consoles, and file stores. A healthy deployment leaves a clear audit trail of what the agent can do, what it actually did, and which credentials it used.

Q: Should organisations use workload identity instead of request-based JIT for AI agents?

A: In most cases, yes, because verified workload identity binds short-lived credentials to a known machine or service context. That is different from minting access because a model produced a plausible sentence. The decision point is whether the organisation wants ephemerality enforced by platform trust or merely promised by generated text.

Technical breakdown

Why intent-based JIT fails for AI agent identities

Just-in-time access assumes the request itself is a trustworthy signal. With AI agents, the request is often a model-generated sentence shaped by prompt, context, and external text the agent has ingested. That makes the authorisation input unstable: the access broker is not validating a verified plan, only a plausibly framed string. In practice, prompt injection turns the intent field into attacker-controlled input, so the access system can correctly authorise the wrong thing. The mechanism is especially weak when the agent’s declared task can be rewritten mid-session by new context or tool output.

Practical implication: treat declared agent intent as untrusted input, not an authorisation basis.

Why short-lived credentials do not reduce agent blast radius

JIT reduces the lifetime of a credential, not the amount of damage that credential can do while it exists. An AI agent can read, decide, call tools, and complete chained actions much faster than the expiry window closes. That means the platform has created ephemerality without constraining reach. If the scoped credential allows a sensitive action, the agent can still execute it during the window, including data movement, configuration changes, or downstream API calls. The real control variable is not duration alone but whether the actor’s permissions are bounded to a verifiable, task-scoped identity state.

Practical implication: constrain what the credential can reach, not only how long it lasts.

Why approval loops collapse when the approver is also a model

JIT depends on an approval step that adds human judgement, or at least human accountability. At agent speed, that becomes either an unusable human bottleneck or an auto-approve policy that reintroduces standing privilege in practice. The article also highlights a second failure mode: model-vouched authorisation, where one LLM generates the request and another evaluates it. That is not independent review. It is a chained guess, and both components inherit the same injection and hallucination risks. Once agents can branch into sub-agents and nested tool calls, the initial approval no longer describes the later activity.

Practical implication: do not let approval automation erase the human or policy boundary it was meant to enforce.

Threat narrative

Attacker objective: The attacker aims to make the agent authorise and execute sensitive actions on the attacker’s behalf while preserving the appearance of a legitimate, time-bound access grant.

1. Entry occurs when a poisoned prompt, ticket, README, or webpage influences the agent’s stated intent and turns the access request into attacker-controlled input.
2. Credential access follows when the JIT engine grants a scoped, short-lived credential based on that manufactured intent.
3. Escalation occurs as the agent uses the granted access to call tools, branch into sub-agents, or reach additional systems before the token expires.
4. Impact is the successful execution of sensitive actions, data movement, or configuration changes with an access trail that records the grant but not the full lineage.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Intent-based JIT is a control designed for human requests, not autonomous access generation. Human requests are rare, deliberate, reviewable, and attributable. AI agent requests are continuous, machine-generated, and mutable inside the same task. That means the governance assumption behind JIT collapses before the credential is even issued. The implication is that authorisation design must stop treating declared intent as the primary trust signal.

Agentic access creates ephemeral privilege without ephemeral reach. The industry often equates shorter credential lifetime with lower risk, but the article shows that the relevant question is whether the actor can outpace the expiry window. An AI agent can do so easily, which means the control changes the clock but not the blast radius. Practitioners should read this as a boundary problem, not a timing optimisation problem.

Model-vouched access is not independent approval. When one model generates the request and another model approves it, access governance becomes a closed loop of correlated guesses. That is structurally weaker than a human or policy-backed approval chain because the same prompt-injection and reasoning errors can pass through both stages. The practitioner conclusion is simple: the approval function must not be allowed to collapse into model self-attestation.

Identity lineage becomes the decisive control plane for agent access. The article is right to insist that investigations need person-to-agent-to-tool-to-identity-to-action-to-resource traceability. Without that lineage, ephemeral credentials erase evidence as fast as they remove access. For IAM and NHI programmes, the governing question is no longer whether access was short-lived, but whether the organisation can prove what the identity did while it existed.

Workload-bound ephemerality is not the same as request-based ephemerality. Short-lived, platform-enforced credentials tied to verified workload identity behave differently from credentials minted because a sentence sounded plausible. That distinction matters because one is anchored in machine identity governance and the other is anchored in trust of generated text. Practitioners should treat those as separate operating models, not interchangeable JIT variants.

From our research library:

• 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Identity lineage is the missing control plane for agent access: access reviews and approval workflows fail when they only capture the grant event. For AI agents, the programme needs traceability from person to agent to tool to resource, because the thing being governed is the execution chain, not the request sentence.

Ephemeral access is only useful when the platform enforces it: policy-driven JIT grants can still leave full blast radius in place while the credential exists. That makes workload-bound identity and ownership tracking more defensible than request-time intent scoring.

Security leaders are already admitting the governance gap: according to the 2026 Infrastructure Identity Survey, 7% of security leaders do not know how often their AI systems are making autonomous changes to infrastructure. That uncertainty is a sign that auditability is lagging behind deployment speed.

For practitioners

• Map every agent to a real identity Inventory the non-human identities an agent can assume, the human owner behind each one, and the systems each identity can reach before any access is granted.
• Remove intent as a trust signal Treat prompt text, tickets, README files, and other agent inputs as untrusted content when they influence authorisation decisions or access brokerage.
• Replace request-based JIT with platform-bound ephemerality Use workload-bound, short-lived credentials that are issued through verified identity controls rather than through a model-generated access request.
• Require full identity lineage for investigations Ensure logs connect person, agent, tool, credential, action, and resource so incident responders can reconstruct what happened after the token disappears.
• Baseline agent behaviour before enforcing boundaries Record what each agent normally does, then alert on deviations in tool usage, scope, and target systems instead of trusting declared intent.

Key takeaways

• Just-in-time access fails for AI agents because the control depends on human-style intent, review, and accountability that agent workflows do not provide.
• The core risk is not only shorter-lived credentials, but short-lived credentials that still retain full blast radius during the window they exist.
• Agent access is safer when identity, lineage, and platform-enforced ephemerality are governed directly rather than inferred from generated text.

Key terms

• Just-in-Time Access For Agents: A time-bound access model applied to AI agents in which credentials are issued for a specific task and revoked when the task ends. In practice, this pattern is fragile when the task signal is generated by the same system that receives the access, because intent can be manipulated and cannot be assumed to be human-reviewed.
• Identity Lineage: Identity lineage is the traceable relationship between a human owner and the non-human identities that person creates, authorises, or depends on. It allows security teams to connect service accounts, API keys, tokens, and AI agents back to accountable ownership for review, audit, and retirement decisions.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Workload Identity: The identity assigned to a software workload, such as a containerised application, serverless function, or microservice, enabling it to authenticate to other services without storing static credentials.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.