Notifications
Clear all
Topic starter
21/08/2026 4:44 pm
TL;DR: Agents break least-privilege assumptions because their access surface emerges at runtime, not at provisioning time, according to Noma Security’s analysis. The real governance gap is that access review, OAuth and OIDC models, and standing-permission controls were designed for predictable sessions, while agentic systems can change intent, tools, and impact mid-session.
NHIMG editorial — based on content published by Noma Security: Does Access Control Work When the Agent Starts Deciding for Itself?
By the numbers:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when AI agents are given standing privileges?
A: Auditability, containment, and accountability all degrade.
Q: Why do AI agents complicate privilege management for IAM teams?
A: AI agents can authenticate, call tools, and act with delegated authority, which means they behave like non-human identities with real execution power.
Q: How can security teams tell whether agent access is actually under control?
A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.
Practitioner guidance
- Inventory every agent and delegated credential Build a live register of agents, sub-agents, service accounts, API keys, and tokens that can reach production data or tools.
- Replace standing privilege with task-scoped access Issue credentials per session or per task, and expire them when the workflow completes.
- Separate instructions from retrieved content Treat untrusted documents, tickets, emails, and retrieved context as data only, and enforce a policy layer that evaluates whether a proposed tool call matches the approved task before execution.
What's in the full article
Noma Security's full article covers the operational detail this post intentionally leaves for the source:
- Its detailed breakdown of how runtime context changes the agent access surface across a session.
- Its discussion of the confused deputy failure mode and why intent manipulation matters even when permissions are valid.
- Its comparison of task-scoped access, standing privilege, and external runtime enforcement in agentic systems.
- Its examples of how traditional IAM standards behave when agents act across delegated and loosely bounded sessions.
👉 Read Noma Security's analysis of why agent access control breaks at runtime →
Agent identity and access control: are your controls keeping up?
Explore further
21/08/2026 5:04 pm
Standing privilege for agents is a broken premise, not just a weak control. Static entitlement models were designed for principals whose required access is knowable before execution. That assumption fails when the actor decides what to reach for at runtime, because the access path is assembled from context, memory, and tool choice. The implication is that governance has to stop pretending agent privilege is stable enough for traditional review cadence.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, which means the access model is already lagging the operating model.
A question worth separating out:
Q: Who is accountable when an autonomous agent takes an unsafe action?
A: Accountability should sit with the owner of the agent, the approver of the policy, and the team operating the downstream system. If those responsibilities are not explicit, incident review becomes a blame exercise instead of a control review. The safest model is to predefine ownership before deployment, then validate it through access and audit processes.
👉 Read our full editorial: Agent access control fails when runtime decisions shape privilege
