Topic starter
06/06/2026 2:07 am
TL;DR: AI agents are moving from experimentation to execution layers, taking actions through APIs, SSH, file systems, and databases, which shifts the security problem from static access to runtime decision-making, according to SSH Communications Security. Traditional PAM controls still matter, but they now need ephemeral identity, fine-grained authorization, and full session visibility because the agent decides how to use its access.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “PAM & AI Agents”.
Key questions
Q: What breaks when AI agents are managed with human PAM processes?
A: Human PAM processes assume stable sessions, visible request patterns, and access that persists long enough to be reviewed.
Q: Why do AI agents increase the risk of over-privileged API access?
A: AI agents often need to move across systems quickly and may reuse the same identity for multiple actions.
Q: How can teams tell whether AI access is actually under control?
A: Look for evidence that access is limited by purpose, not just by account.
Practitioner guidance
- Define the agent runtime as a trust boundary Classify local machines, Kubernetes, serverless, and SaaS runtimes separately so access, telemetry, and containment controls follow the execution environment.
- Replace durable credentials with ephemeral issuance Issue task-scoped identities that expire when the agent finishes work, and avoid static API keys or reused service identities where possible.
- Constrain delegated identity explicitly Limit user-on-behalf-of access by time, scope, and approval rather than cloning the user's full rights into the agent context.
Bottom line: AI agents are now acting as execution-layer identities, which means traditional PAM assumptions built around static access no longer describe the real control problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:36 am
AI agent identity is becoming a PAM problem, not an exception case. The article shows that agents are now acting through the same protocols PAM already governs, but with non-deterministic decision-making layered on top. That changes the control objective from brokering human access to governing a runtime actor that can choose different actions for the same task. The implication is that PAM design now has to account for execution variability, not just privileged entry.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between delegated identity and full privilege cloning for AI agents?
A: Delegated identity means the agent acts within a bounded slice of the user's authority, with explicit limits on time, scope, and approval. Full privilege cloning copies the user’s access wholesale, which expands the blast radius and removes task-level restraint. For AI agents, delegated identity is the safer pattern because it preserves context without importing unnecessary rights.
👉 Read our full editorial: AI agent identity and PAM controls need a new operating model