Topic starter
25/06/2026 1:13 am
TL;DR: Agentic AI shifts identity from passive prompt handling to runtime action, multi-step delegation, and tool use across LLMs, MCP servers, and downstream services, creating authentication and authorization gaps that current IAM patterns do not fully cover, according to Aembit. The core problem is not just stronger auth, but governance built on assumptions that no longer hold once agents decide, act, and recompose permissions dynamically.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “The Definitive Catch-Up Guide to Agentic AI Authentication”.
Key questions
Q: What breaks when agentic AI relies on static IAM assumptions?
A: Static IAM breaks when the system can decide new steps at runtime.
Q: Why do agent and service delegation chains create authorisation risk?
A: Because each hop can change the acting identity.
Q: How should security teams govern MCP tool access in enterprise environments?
A: Security teams should bind MCP tool access to enterprise identities, entitlements, and lifecycle state before a request reaches production tools.
Practitioner guidance
- Define runtime delegation boundaries Map where the agent acts under its own identity, where it inherits user context, and where downstream services must not receive implicit trust.
- Classify MCP trust boundaries explicitly Document the authentication method, token type, and approval model for application to LLM API, MCP client to MCP server, and MCP server to service flows.
- Separate discovery from authorisation Treat tool discovery as capability exposure, not as permission grant.
Bottom line: Agentic AI pushes authentication and authorisation into the runtime path, where agents can choose tools and alter their scope during execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:29 am
Runtime permission discovery is the new identity risk surface: Agentic systems do not merely consume permissions, they discover them while they work. That breaks the older assumption that least privilege can be completely specified before execution begins. The implication is that identity governance has to account for permission emergence during task execution, not just provisioning time.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations avoid inheriting user permissions into agent actions?
A: When the action can become broader than the original user request, especially if the agent can write, create, or update records after starting from a read-only intent. In those cases, inheriting the user’s permissions can hide the real decision-maker and let the agent exceed the scope that would be acceptable on its own.
👉 Read our full editorial: Agentic AI authentication is breaking old IAM assumptions