Zero trust access at the last mile now has NHI implications

At a glance

What this is: This is an analysis of why last-mile zero trust matters for both human and non-human identities, with the central finding that network-only enforcement misses session activity and AI agent access.

Why it matters: IAM and NHI teams need to care because authentication alone does not govern what happens inside the session, where data exposure, lateral movement, and tool use actually occur.

By the numbers:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• Only 5.7% of organisations have full visibility into their service accounts.
• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.

👉 Read Island's analysis of zero trust access at the last mile

Context

Zero trust access only works as intended when enforcement follows the identity into the application session, not just to the login boundary. In environments where AI agents and service accounts access internal tools, APIs, and data sources, network-level authentication alone leaves the real risk surface uncovered.

The article argues that last-mile control is the missing layer in many deployments, especially where unmanaged devices, contractors, and AI agents need access without broad network exposure. That is a genuine IAM and NHI governance problem, not just a connectivity problem.

For teams managing hybrid identity estates, the practical question is whether policy still applies after authentication, across browser, endpoint, and machine-to-machine activity. That is where zero trust becomes an identity control rather than a perimeter label.

Key questions

Q: How should security teams govern access when AI agents and humans share the same apps?

A: Treat AI agents as separate identity subjects with their own approvals, scope limits, and monitoring. Human access policy assumes a person controls the session, but agentic access can chain actions across tools and timing. Governance should separate authentication from authorisation and require explicit policy for non-human actors before they are allowed to reach business apps.

Q: Why do zero trust programmes fail when they stop at the network layer?

A: Because the network boundary is not where most misuse happens. Once a subject is authenticated, the real risk appears inside the session, where data can be copied, downloaded, printed, or acted on unless those controls are enforced at the point of use.

Q: What breaks when unmanaged devices are allowed into internal apps without session controls?

A: You lose the ability to govern what happens after access is granted. If the device is not managed and the session is not constrained, users or agents may reach sensitive systems while bypassing the protections that should limit data movement and exfiltration.

Q: Who is accountable when zero-trust access decisions fail?

A: Accountability sits with the IAM, PAM, and security owners who define the access model and the operational owners who enforce it. If a compromised identity can still reach sensitive systems, the failure is usually governance, segmentation, or revocation control, not just authentication. Strong policy without enforceable lifecycle control does not contain exposure.

Technical breakdown

Why network-layer zero trust stops short of session governance

Traditional ZTNA narrows access to an application, but it still often enforces policy before the session is fully in view. That leaves the browser, endpoint, and in-session data actions outside the same control boundary. Last-mile access changes the security model by evaluating identity, device posture, and context at the point of use, then applying controls such as clipboard blocking, download restrictions, and screenshot prevention inside the session itself.

Practical implication: measure whether your access controls continue after authentication and whether session-level data controls are actually enforced.

How AI agent access via MCP changes the identity problem

When an AI agent calls tools through MCP, queries internal systems, or chains actions at runtime, the access event is no longer a one-time human login. The identity is non-human, the action rate is machine speed, and the risk is cumulative across many calls rather than one session. That makes access governance depend on identity, posture, and policy evaluation for every request, not just the first handshake.

Practical implication: classify AI agents as governed identities and review whether your access model can evaluate each tool call separately.

Why unmanaged devices create a zero trust enforcement gap

Unmanaged and BYOD devices cannot rely on endpoint ownership assumptions, which is why browser-based or endpoint-mediated enforcement matters. The key architectural idea is that access should be brokered without exposing the internal network, using outbound-only connectors and application-specific policy rather than broad network reachability. That keeps private resources invisible while still allowing selective access to web, RDP, SSH, and native workflows.

Practical implication: separate network reachability from application authorization and remove any dependency on persistent device trust.

Threat narrative

Attacker objective: The objective is to use apparently legitimate access to reach private applications and data without the session controls that would normally contain misuse.

1. entry: A user, contractor, or AI agent enters through authenticated access that looks narrow at the network layer but still reaches internal applications and data sources.
2. escalation: The session becomes the real control point, and if policy stops at login, the actor can query tools, move data, or chain actions without further identity checks.
3. impact: Sensitive information can be viewed, copied, or operationally altered even though the original access decision appeared least-privilege on paper.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Last-mile zero trust is the real identity boundary: Authentication without session governance leaves the most important risk unresolved. The article correctly shifts the focus from network entry to what happens after access is granted. For IAM and NHI programmes, that means the control point must follow the identity into the session, not stop at the perimeter.

AI agent access breaks assumptions built for human-paced decisions: Access review processes were designed for sessions that persist long enough to be observed and certified. That assumption fails when an AI agent can call tools, query data, and chain actions at machine speed. The implication is that identity governance must stop treating runtime access as a static entitlement problem.

Session controls are becoming identity controls: Clipboard, download, print, and screenshot restrictions are no longer just DLP features. They are part of identity enforcement because they determine what an authenticated subject can do with access once inside the application. Practitioners should treat these controls as part of the access decision itself.

Zero trust for unmanaged devices still depends on lifecycle discipline: Contractors, seasonal workers, and newly acquired teams are not special cases, they are recurring governance scenarios. The real issue is whether access is scoped to the task and ends cleanly when the relationship changes. If it does not, zero trust becomes a temporary label on persistent exposure.

Named concept. last-mile access governance: This is the control model that aligns identity, device posture, and session policy at the point where work actually happens. It matters because network-level least privilege is incomplete if data handling, tool use, and internal resource access remain outside enforcement. Practitioners should assess whether their zero trust programme governs the full interaction, not just the login.

From our research:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, which is why lifecycle discipline is still a control gap for many identity teams.
• For a broader view of how these failure modes show up in practice, see 52 NHI Breaches Analysis for recurring patterns and root causes.

What this signals

Last-mile access governance: The next phase of zero trust is less about moving the perimeter and more about extending policy into the session itself. For identity teams, that means browser controls, endpoint mediation, and non-human access need to be governed together, not as separate security projects.

With 90% of IT leaders saying properly managing NHIs is essential for zero trust, the operating model is already clear even if implementation is not. The challenge now is to decide whether unmanaged devices and AI agents are being handled as exceptions or as first-class identities, then align policy accordingly.

For practitioners, this shifts the programme question from "Can they log in?" to "What can they do after access is granted?" That is the point where session logging, data handling controls, and identity lifecycle governance start to converge into one programme boundary.

For practitioners

• Map where policy stops at login Identify every access path where authentication is enforced but session activity is not. Pay particular attention to browser sessions, unmanaged devices, and AI agent tool calls that can still reach internal data.
• Classify AI agents as governed identities Treat agent tool use, API calls, and chained actions as access events that require identity and context checks. Do not let machine-speed execution inherit human login assumptions.
• Extend controls into the session layer Evaluate whether clipboard blocking, download restrictions, print controls, and screenshot prevention are applied as part of the access decision. If they are separate from authorization, the policy boundary is too early.
• Separate device trust from application trust Allow access to the application without exposing the broader network. Use outbound-only patterns and app-specific authorization so unmanaged and BYOD devices do not become a shortcut to internal reachability.

Key takeaways

• Zero trust that ends at authentication does not govern the real risk surface inside the session.
• AI agents and unmanaged devices force identity teams to treat access as a continuous, context-aware control problem.
• Practitioners should extend governance into browser, endpoint, and data-use controls or accept that least privilege stops too early.

Key terms

• Last-Mile Access Governance: The control model that governs what an authenticated subject can do inside the session, not just whether they can connect. It extends identity, posture, and policy into browser, endpoint, and application activity so data use, tool use, and movement are constrained where work actually happens.
• Session-Level Data Controls: Controls that restrict what a user, contractor, or agent can do with data after access has been granted. Examples include download blocking, clipboard restrictions, screenshot prevention, and print controls. In modern identity programmes, these are part of enforcement, not separate convenience features.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

What's in the full article

Island's full article covers the operational detail this post intentionally leaves for the source:

• How the browser-based control path brokers access to web, RDP, and SSH sessions
• How the endpoint path extends the same policy model to native applications and all-device traffic
• How the connector architecture keeps private resources off the public internet
• How last-mile data controls are enforced across clipboard, downloads, printing, and screenshots

👉 Island's full post covers the access architecture, session controls, and unmanaged device model in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.