Topic starter
24/07/2026 4:09 pm
TL;DR: Agentic systems break the assumption that access can be fully enumerated at provisioning time, because runtime decisions change what they need to reach, and over-permissioned agents can amplify small errors into large incidents, according to Noma Security. Static least-privilege models are no longer enough when permissions, autonomy, and task scope all move during execution.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “That’s a Great Question – Does Access Control Work When the Agent Starts Deciding for Itself?”.
By the numbers:
- Research from BeyondTrust reports a 466.7% year-over-year increase in AI-driven identities and automation inside enterprises.
Key questions
Q: What breaks when least privilege is applied as a static model in modern environments?
A: Static least privilege breaks when identity and workload needs change faster than access reviews can keep up.
Q: Why do over-permissioned agents create more risk than ordinary automation?
A: Ordinary automation follows a fixed path, but an agent can choose among tools and adapt its next step based on intermediate results.
Q: What are the signs that delegated agent access is failing governance?
A: Common signs include missing provenance, broad permissions that outlast the task, and audit records that show what happened but not who effectively authorised it.
Practitioner guidance
- Map agent access to task boundaries Define what each agent must reach for a specific task, then remove any access that is not directly required for that execution path.
- Replace standing privilege with task-scoped issuance Issue credentials per session or per task so the agent does not retain reusable access across unrelated actions or workloads.
- Add external runtime enforcement Place a control outside the agent harness that evaluates intended actions before execution and blocks requests that do not fit the task context.
Bottom line: Agentic systems expose a basic IAM mismatch because access needs can change after execution starts, not just before deployment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:14 pm
Static IAM assumptions collapse when the actor decides at runtime. Least privilege was designed for identities whose access needs can be enumerated before execution begins. That assumption fails when an agent assembles its own tool path from context, memory, and retrieval. The implication is not merely broader policy design, but a new governance model that treats access as a moving target.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern agent activity when it can move data autonomously?
A: Teams should treat agent activity as a governed operating behaviour with explicit permissions, observed actions, and bounded destinations. If the agent can read, summarise, or redistribute sensitive information, those actions need runtime control and auditability, not just policy language.
👉 Read our full editorial: Agentic access control is outgrowing static IAM assumptions