Topic starter
25/06/2026 12:53 am
TL;DR: Consumer-ready AI agents are driving more non-human traffic into customer journeys, exposing gaps in device fingerprinting, bot detection, and auditability as identity and fraud controls converge, according to Transmit Security. Traditional stacks assume stable human-driven sessions, but agent-mediated actions now require policies that distinguish trusted delegation from hijacked automation.
Editorial analysis by NHI Mgmt Group, based on content published by Transmit Security: “Mosaic by Transmit Security: Built with Google Cloud AI to Redefine Identity and Fraud Prevention in the Era of Consumer AI Agents”.
Key questions
Q: Should AI agents inherit the same permissions as the users they represent?
A: They should inherit only the subset of permissions that the user could exercise for that specific task, not the user’s entire access profile.
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: What are the signs that agent-mediated actions are being misclassified?
A: Common signs include unexplained false declines, inconsistent session attribution, missing audit context for transactions, and controls that cannot tell trusted delegation from hijacked automation.
Practitioner guidance
- Define agent-specific authorization rules Separate human entitlements from AI agent task permissions so delegated software never inherits a full customer or employee privilege set by default.
- Require human re-entry for sensitive actions Insert approval or re-authentication points before high-risk actions such as payments, account changes, or financial transactions that exceed the original task scope.
- Tag sessions with agent context Record whether the action path was human, delegated, or autonomous so fraud analysts can distinguish legitimate automation from compromised activity.
Bottom line: AI agents are collapsing the old separation between identity assurance and fraud prevention in customer journeys.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:57 am
Identity and fraud can no longer be treated as separate control planes: consumer-ready AI agents collapse the boundary between who is acting and how risk is detected. Fraud controls that only score behaviour miss delegation context, while IAM controls that only prove identity miss malicious intent. The fused model is now a governance requirement, not a design preference, for programmes that must manage human and agent activity in the same journey.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do teams decide whether an AI agent needs human approval?
A: Use the sensitivity of the action, not the cleverness of the model, as the decision point. If the agent can change records, move funds, send external messages, or access regulated data, human approval or an independent policy engine should remain in the path. The more irreversible the action, the less autonomy the agent should have.
👉 Read our full editorial: AI agent identity and fraud controls need a fused model