Notifications
Clear all
Topic starter
25/06/2026 12:27 am
TL;DR: Enterprises are treating agentic AI as production-ready too early, while real failures such as identity provider outages, delegated token chains, and corrupted claims expose gaps that unit tests miss, according to Strata Identity. The core issue is that agentic systems need failure rehearsal, not just functional validation, because identity assumptions break under turbulence.
NHIMG editorial — based on content published by Strata Identity: Agentic Identity Sandbox and AI resilience testing
Questions worth separating out
Q: How should security teams test agentic identity controls before production?
A: Teams should use controlled failure scenarios that break identity assumptions, not just functional tests.
Q: When does delegated access become too risky for AI agents?
A: Delegated access becomes too risky when the agent can chain permissions across services or clouds in ways the original approval did not describe.
Q: What breaks when identity systems are only tested on the happy path?
A: What breaks is the organisation’s ability to predict failure.
Practitioner guidance
- Rehearse IdP outage scenarios Test whether critical agent workflows survive primary identity provider failure without creating uncontrolled fallback paths or silent access expansion.
- Inject broken identity artefacts Use expired tokens, manipulated claims, and corrupted policies in a controlled sandbox to verify that guardrails fail closed instead of degrading quietly.
- Map delegated token chains Trace On-Behalf-Of and related delegation paths across cloud boundaries so you can see where permissions cascade beyond the original trust boundary.
What's in the full article
Strata Identity's full blog post covers the operational detail this post intentionally leaves for the source:
- Hands-on sandbox scenarios for simulating IdP outages, delegated token chaining, and corrupted identity artefacts.
- Practical examples of how teams can test observability, logging, and response workflows under degraded conditions.
- Implementation detail on using the sandbox as a mission-control style rehearsal environment for agentic identity.
- The article's hands-on lab framing for binding, delegating, and observing authentication and authorisation policies in real time.
👉 Read Strata Identity's analysis of the Agentic Identity Sandbox for AI resilience →
Agentic identity sandboxing: can your controls survive real failure?
Explore further
25/06/2026 9:21 am
Agentic identity sandboxes turn theoretical governance into observable control failure. The central value is not simulation as training theatre but simulation as proof of where trust assumptions collapse under pressure. Unit tests cannot tell you whether an IdP outage, corrupted claim, or delegated token chain will fail closed or fail open. Practitioners should treat rehearsal as part of identity assurance, not an optional extra.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: How do teams know if agentic identity observability is working?
A: Observability is working when responders can reconstruct who acted, which token path was used, what the agent accessed, and how the system behaved during degradation. If logs overflow, auth timeouts hide the sequence, or artefacts disappear under load, the programme has visibility in name only.
👉 Read our full editorial: Agentic identity sandboxing is becoming mission-critical for AI resilience
