TL;DR: AI agents are moving into critical workflows with decision-making and API chaining, but static provisioning, long-lived credentials, and human-era governance models do not scale to their velocity or delegation patterns, according to Strata Identity. The core issue is that identity systems assume stable, reviewable access, while agents appear, act, and retire faster than those controls can track.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Strata Identity's blog post: Just-in-time identity is being positioned as the answer to AI agents that act autonomously, chain APIs, and outgrow static provisioning and long-lived credentials.
Why it matters: IAM, PAM, and NHI teams need to understand where human-era governance assumptions fail, because agent runtime behaviour changes how delegation, traceability, and least privilege must be enforced.
Context
AI agents create an identity governance problem because the controls built for people assume stable accounts, predictable lifecycles, and reviewable access. That model weakens when identities appear only for a task, act through delegated scopes, and disappear before a normal access review cycle can catch them.
The article treats just-in-time provisioning as a runtime governance pattern for AI agents, not a convenience feature. The core question is whether identity can be issued, scoped, and retired fast enough to preserve accountability without defaulting to standing credentials and overbroad entitlements.
Key questions
Q: What breaks when AI agents inherit human IAM controls?
A: Human IAM controls break because they assume a person makes a request, waits, and can later be reviewed or deprovisioned. AI agents can chain actions, spawn downstream agents, and complete tasks faster than review cycles can observe. The result is weak attribution, stale privilege, and revocation paths that are too blunt to contain one actor cleanly.
Q: Why do long-lived secrets create more risk for workloads and agentic AI systems?
A: Long-lived secrets increase blast radius because any exposed key can be reused until it is rotated or revoked. In workload and AI environments, those credentials are often embedded in automation, shared across services, or retrieved repeatedly, which weakens accountability. Short-lived, identity-based access reduces persistence, limits reuse, and makes compromise easier to contain.
Q: How should security teams handle delegated access when AI agents act on behalf of customers?
A: Security teams should treat delegated access as a separate governance layer, not as a normal login session. Define what the agent can do, how much value it can move, which approvals are required, and how delegation is revoked. Without those boundaries, the agent inherits more authority than the customer intended and fraud risk expands quickly.
Q: When should organisations replace static agent accounts with just-in-time provisioning?
A: They should do it when agents are task-scoped, short-lived, or capable of chaining multiple actions across systems. In those conditions, persistent accounts become a governance liability because the control model cannot reliably match privilege duration to actual execution time.
Technical breakdown
Why static provisioning fails for AI agents
Static provisioning depends on creating identities before work begins and keeping them long enough to govern through joiner, mover, leaver processes. AI agents break that assumption because they can be spawned dynamically, exist for seconds or minutes, and appear in large bursts inside a single workflow. When the identity lifecycle is tied to human-paced administration, the result is operational drag, excessive standing access, and a weak control boundary between task initiation and privilege grant.
Practical implication: move identity issuance closer to task execution so access exists only for the work being performed.
How long-lived credentials create identity debt
When organisations avoid runtime issuance, they tend to fall back on pre-shared secrets, service accounts, and broad permissions that can “cover all cases.” Those credentials become difficult to rotate, hard to audit, and easy to leave unused while still valid. In NHI terms, that is credential sprawl combined with overprivileged access, which expands attack surface even when no agent is active. The governance issue is not just excess access, but access that persists after the business need has changed.
Practical implication: treat AI agent credentials as short-duration assets and eliminate any pattern that depends on reusable standing secrets.
Why delegation and provenance matter at runtime
AI agents frequently act on behalf of humans or other systems, so identity is no longer just about authentication. It becomes a question of delegation chain, provenance, and traceability. Without dynamic binding, teams cannot reliably answer who authorised the action, what the agent was allowed to do, or which identity in the chain initiated the workflow. That makes incident review and compliance evidence weak, especially when multiple agents or downstream APIs are involved in the same transaction.
Practical implication: make delegation and provenance first-class identity attributes, not metadata added after the incident.
Breaches seen in the wild
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Access review assumes privilege lasts long enough to be reviewed, and that assumption fails for AI agents. Human-era governance expects identities to persist across a review window, but agentic systems may acquire, use, and discard access inside one task. That means the core control premise is broken before the review even starts. Practitioners need to recognise that this is not a faster version of human IAM; it is a different timing model altogether.
Just-in-time identity is really runtime authority control for delegated execution. The important shift is not issuance alone, but when authority exists and how narrowly it is bound to the task. That matters because agents often need to chain APIs and make decisions mid-session, which makes static role design too coarse for the operating model. The field should treat runtime scoping as the control plane, not a convenience wrapper around provisioning.
Ephemeral credential trust debt is the right named concept for this problem. Every workaround that uses broad, long-lived credentials for agents accumulates future risk that is not visible in the moment of issuance. The debt shows up later as poor traceability, uncertain ownership, and difficult revocation. NHI governance has to move from account accumulation to expiration-aware authority, or the control model will remain permanently behind the workload.
Delegation provenance becomes a governance requirement when agents act on behalf of humans and systems. Without a stable binding between the delegator, the agent, and the action, accountability fragments across the chain. That weakens incident response, auditability, and policy enforcement at the exact point where agentic workflows are becoming operational. Practitioners should treat provenance as part of identity, not as an afterthought in logging.
Zero Trust for agents is not about adding more checks after login; it is about preventing standing authority from becoming the default state. The article’s logic aligns with a broader move away from persistent entitlements and toward task-bound access. That validates runtime governance patterns for AI agents and makes static service-account thinking harder to defend in mixed human, NHI, and agentic environments.
From our research library:
- A May 2025 Gartner poll of 147 CIOs and IT leaders found that 24% had already deployed AI agents, 50% were experimenting and 17% planned to deploy by the end of 2026.
- Read next: Agentic AI Identity Guide
What this signals
Ephemeral credential trust debt: When AI agents are allowed to accumulate broad, reusable credentials, the organisation inherits future risk in the form of stale access, weak attribution, and delayed revocation. Runtime governance has to replace the assumption that access can be safely reviewed after the fact.
Identity programmes that were built around stable accounts should expect pressure at the issuance layer first. The control question is no longer only who can log in, but whether authority can be created, scoped, and destroyed quickly enough to match delegated execution.
69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey. That level of concern reflects a broader recognition that static IAM patterns are not designed for runtime agent behaviour.
For practitioners
- Implement runtime identity issuance for agent tasks Issue identities only when a specific task begins, bind them to the task scope, and retire them as soon as the workflow ends so access does not outlive the work.
Key takeaways
- AI agents challenge identity governance because they act too quickly and too transiently for human-era provisioning and review cycles to govern effectively.
- The main operational risk is not just more accounts, but more persistent authority than the task actually requires, which expands traceability and revocation problems.
- Runtime scoping and delegation-aware identity controls are becoming the practical boundary between manageable agentic workflows and uncontrolled credential sprawl.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST Zero Trust (SP 800-207) sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on runtime identity issuance and the failure of static agent authentication patterns. |
| NHI-05 — Overprivileged NHI | Broad agent entitlements and over-provisioned service accounts are the article's main governance risk. | |
| NHI-07 — Long-Lived Secrets | The article warns that pre-shared, durable credentials become the fallback when JIT is absent. | |
| Recommendation — Replace static agent authentication with task-bound issuance that expires when the workflow ends. Scope AI agent privileges to the minimum task context and eliminate default broad access. Replace long-lived agent secrets with short-duration credentials and revoke them at task completion. | ||
| NIST Zero Trust (SP 800-207) | Principle of least privilege — Least privilege | The article argues that agent access must be dynamically limited to preserve zero trust principles. |
| Recommendation — Apply least-privilege gating at issuance time so agent access is narrowly constrained by task and context. | ||
| MITRE ATT&CK | TA0004;TA0008 — Privilege Escalation; Lateral Movement | The source links broad static access to escalation and lateral movement risk across systems. |
| Recommendation — Map broad agent entitlements to escalation and lateral movement risk in threat modelling and detection. | ||
Key terms
- Just-in-time identity provisioning: A runtime model that issues an identity only when a specific task needs it and removes it when the task ends. For AI agents, this shifts identity control from pre-created accounts to task-scoped authority that better matches short-lived execution.
- Delegated authority provenance: Delegated authority provenance is the record of who authorised an action, which identity executed it, and under what session or approval context. For agents, this provenance must be preserved per invocation or governance teams lose the ability to attribute behaviour and enforce accountability.
- Credential Sprawl: Credential sprawl is the uncontrolled accumulation of machine secrets, keys, and tokens across systems, teams, and environments. It usually starts with a single use case and ends with overlapping permissions, unclear ownership, and a larger attack surface than the organisation expected.
- Ephemeral authority: Access that exists only for a narrow operational window and disappears when the task completes. For autonomous or agentic systems, ephemeral authority is the practical alternative to standing privilege because it limits how long an agent can act.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org