Notifications
Clear all
Topic starter
22/07/2026 4:35 pm
TL;DR: Agentic AI systems now chain tools, call APIs, and act without human approval at every step, exposing access paths that traditional controls were never built to contain, according to Appgate. The core issue is not model safety alone, but whether identity, privilege, and network reachability are enforced tightly enough to prevent autonomous misuse.
NHIMG editorial — based on content published by Appgate: Zero trust access controls for agentic AI environments
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes - and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams set access boundaries for AI agents?
A: Security teams should define agent boundaries around data sources, tools, and allowed actions before any production rollout.
Q: Why do AI agents create a larger blast radius than traditional automation?
A: AI agents can chain tools, reuse context, and expand their effective reach during execution, which means one over-permissioned identity can affect multiple systems quickly.
Q: What do security teams get wrong about zero trust in agentic access environments?
A: Teams often assume zero trust means the initial connection is enough if the gateway is authenticated.
Practitioner guidance
- Map agent reachability before model governance Inventory every API, MCP endpoint, file store, and internal service an agent can reach today.
- Replace static trust zones with deny-by-default access Use deny-by-default entitlements and micro-perimeters so an agent can only connect to explicitly authorised resources.
- Bind workload identity to every connection Require cryptographic machine identity, short-lived credentials, and identity-attributed logging for all agent connections.
What's in the full article
Appgate's full article covers the operational detail this post intentionally leaves for the source:
- A full mapping of Anthropic's seven AI-agent security domains to specific ZTNA capabilities and control layers.
- Identity and segmentation design detail for server, virtual machine, Kubernetes, and API access patterns in agentic environments.
- The article's broader compliance framing across FedRAMP, CMMC, HIPAA, FINRA, and EU AI Act contexts.
- Why Appgate argues that cloaking MCP endpoints changes the exposure model before application-layer controls are engaged.
👉 Read Appgate's analysis of zero trust controls for agentic AI environments →
Agentic AI access control gaps: what IAM teams need to know?
Explore further
22/07/2026 4:40 pm
Agentic AI exposes an access architecture problem, not just a model safety problem. The article is right to move the discussion from prompt controls to reachability, because autonomous systems can chain tools and persist across sessions in ways that human-centred IAM never had to govern. The field is now dealing with machine-speed use of legitimate access, which makes network exposure and privilege scope part of the security boundary. Practitioners should treat agentic AI as an identity and access design challenge first.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 66% of technology professionals say AI agent risk is immediate, and 96% identify AI agents as a growing security threat, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who should be accountable for agent identity governance?
A: Accountability should sit with one named owner for the agent class, supported by security, IT, and platform teams. Fragmented responsibility leads to inconsistent policies, weak audit evidence, and unclear exception handling. The right model is a single accountable chain for identity, access, logging, and lifecycle decisions.
👉 Read our full editorial: Zero trust access controls are now foundational for agentic AI
