Topic starter
24/06/2026 8:47 pm
TL;DR: Opal Security says Mercari moved AI security from functional silos into a dedicated governance model as LLM and agentic AI adoption accelerated, with focus on authentication, authorization, auditing, tool control, and least agency. The governing assumption has changed: agentic behaviour turns identity into runtime governance, not a static entitlement record.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Customer Voices: How Mercariâs Security Team is Building Guardrails for the AI Era”.
Key questions
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What are the signs that agent tool access is becoming overprivileged?
A: Warning signs include broad tool lists, direct connections to internal systems without a broker, and authorization checks that happen only at login or launch.
Practitioner guidance
- Define agent identity as a governed access class Treat agentic systems as actors whose privileges, tool access, and delegation scope must be explicitly classified and reviewed, rather than folded into generic application access.
- Broker every tool connection through a control point Centralise access to MCP servers, internal APIs, and other AI-connected tools so that the agent never receives direct, unconstrained reach to downstream systems.
- Test for confused-deputy behaviour before rollout Validate whether the agent can be induced to act with authority that exceeds the original request, especially where user intent and system authority can be mixed.
Bottom line: Agentic AI changes the identity problem because the actor can make runtime decisions, so governance has to move beyond static entitlement records.
What's in the full article
Opal Security's full article covers the operational detail this post intentionally leaves for the source:
- Jason Fernandes’ direct comments on how Mercari organised its AI Security function and governance structure
- The team’s practical handling of authentication, authorization, auditing, and tool-control questions across AI use cases
- The internal split between AI in products and AI in the enterprise, including how consultations are routed
- Mercari’s forward-looking plans for AI governance, automated inventories, and guardrails for secure AI enablement
👉 Read Opal Security’s analysis of Mercari’s AI security model and agent guardrails →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:34 am
Agent identity is becoming a governance category, not a side effect of automation: Mercari’s framing shows that once agents can make runtime decisions, identity governance has to account for behaviour, not just assignment. The important shift is that the control subject is no longer a user or workload alone, but an actor that can select actions and tools during execution. That makes least privilege harder to define in advance and harder to validate after the fact. Practitioners should treat agent identity as a first-class governance model, not an extension of existing IAM.
A question worth separating out:
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.
👉 Read our full editorial: Mercari’s AI security model shows why agent identity needs guardrails