Notifications
Clear all
Topic starter
24/07/2026 4:09 pm
TL;DR: Agentic systems break the assumption that access can be fully enumerated at provisioning time, because runtime decisions change what they need to reach, and over-permissioned agents can amplify small errors into large incidents, according to Noma Security. Static least-privilege models are no longer enough when permissions, autonomy, and task scope all move during execution.
NHIMG editorial — based on content published by Noma Security: agentic access control, least privilege, and runtime governance for AI agents
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should security teams enforce least privilege for AI agent identities?
A: Start by treating every agent as an NHI with a dedicated identity, a tight permission boundary, and a named owner.
Q: Why do AI assistants create more risk than traditional service accounts?
A: AI assistants create more risk because they can be influenced by inputs, context, and hidden instructions after authentication succeeds.
Q: What do security teams get wrong about prompt injection defence?
A: They often assume better blocklists will solve the problem, but obfuscation simply changes the shape of the payload.
Practitioner guidance
- Inventory every agent and its reachable systems Build a complete register of formal agents, embedded automations, and shadow AI workflows.
- Replace standing privilege with task-scoped JIT access Issue credentials for a specific session and objective, then expire them when the task ends.
- Separate decision from execution Place an external control layer between the agent’s output and the action it is about to take.
What's in the full article
Noma Security's full article covers the operational detail this post intentionally leaves for the source:
- The article expands on the No Excessive CAP model and how to evaluate capabilities, autonomy, and permissions together.
- It explains the confused deputy pattern in agentic workflows with more detail on instruction-hijacking and hidden directives.
- It discusses how runtime enforcement and external control planes can sit between decision and execution in practice.
- It adds context from NIST and AWS submissions that is useful if you are building an implementation roadmap.
👉 Read Noma Security's analysis of agentic access control and least privilege →
Agentic access control: what IAM teams need to rethink now?
Explore further
24/07/2026 4:14 pm
Standing privilege is the governance failure that agentic systems expose first. The article shows that teams often compensate for runtime uncertainty by granting broad access upfront, then promise to tighten it later. That pattern fails because later is already too late once the agent can decide, retrieve, and act on its own. The implication is that identity governance must stop treating broad access as a temporary convenience.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, showing that the governance gap is already recognised at senior levels.
A question worth separating out:
Q: Who is accountable when an autonomous agent misuses access or exposes data?
A: Accountability should sit with the team that owns the agent lifecycle, policy, and runtime enforcement, not with the agent itself or with the model provider alone. If multiple groups share the control plane, they still need one named governance owner for recertification, monitoring, and incident escalation. Otherwise, the gap becomes a governance failure, not a technical one.
👉 Read our full editorial: Agentic access control is outgrowing static IAM assumptions
