Topic starter
13/10/2026 10:40 am
TL;DR: PlainID argues that OWASP’s Top 10 for Agentic Applications requires runtime authorization because agent workflows plan, call tools, hand off work, and retain memory across steps, which lets authority spread beyond intended limits. The core security problem is least agency: access must be evaluated at every transition, or delegated actions can become open channels to data and systems.
Editorial analysis by NHI Mgmt Group, based on content published by PlainID: “PlainID and the OWASP Top 10 for Agentic Applications (2026)”.
Key questions
Q: What breaks when agent permissions are evaluated only at login?
A: When permissions are evaluated only at login, revocation, demotion, or offboarding may not take effect until the session ends.
Q: Why do agentic systems need per-hop authorization instead of one-time approval?
A: Because the risk is not only who started the task, but what the agent does after the first decision.
Q: What are the signs that an agent is overstepping its intended authority?
A: Common signs include broad tool discovery, repeated access to unrelated resources, unusual sub-agent handoffs, and actions that are not tightly tied to the original purpose.
Practitioner guidance
- Define least agency for each agent workflow Document the minimum authority each agent needs to complete a bounded task, then deny any inherited access that is not required for that task’s current step.
- Authorize every tool and API hop Evaluate tool choice, operation, parameters, resource target, and risk context before an agent can invoke an MCP server, API, or execution action.
- Separate human, agent, and sub-agent identities Model each actor in the delegation chain as a distinct identity so effective access can be reduced by intersection rather than expanded by inheritance.
Bottom line: Agentic AI changes access governance because authority can spread across planning, tool use, and delegation steps rather than staying fixed at login.
What's in the full article
PlainID's full article covers the operational detail this post intentionally leaves for the source:
- The full OWASP Top 10 for Agentic Applications mapping from ASI01 through ASI10 with PlainID's control boundaries.
- Examples of runtime authorization decisions across human, agent, sub-agent, tool, and data transitions.
- PlainID's description of how policy, approval, and audit are applied at each hop in the delegation chain.
- The vendor's capability-by-capability explanation of bounded authority, parameter controls, and revocation paths.
👉 Read PlainID's analysis of runtime authorization for the OWASP Top 10 for Agentic Applications →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 10:40 am
Least agency is becoming the decisive control boundary for agentic systems. The article correctly frames the problem as a mismatch between dynamic agent behaviour and static enterprise permissioning. That mismatch is not solved by adding more policy at onboarding, because the real risk appears when the agent starts planning, calling tools, and passing work onward. Practitioners should now treat runtime authorization as the point where identity governance becomes executable.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between static least privilege and least agency for agents?
A: Static least privilege assumes the required access can be defined once and left in place. Least agency assumes the agent’s authority must be narrowed continuously as the workflow unfolds, because intent, tool choice, and execution path can change at runtime. That makes least agency a living control, not a provisioning decision.
👉 Read our full editorial: Runtime authorization defines agentic AI access boundaries