Topic starter
12/06/2026 9:44 pm
TL;DR: Agentic AI systems can autonomously plan, choose tools, and execute actions across enterprise systems, which materially expands the attack surface for privilege abuse, data exposure, and untraceable decisions, according to Lasso Security. Existing IAM and governance models were built for request-response systems, not actors that can alter execution paths at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Lasso Security: “What is Agentic AI? Benefits, Security Risks & Use Cases”.
Key questions
Q: What breaks when AI agents are given broad enterprise access without tight governance?
A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: How can teams tell whether AI access is actually under control?
A: Look for evidence that access is limited by purpose, not just by account.
Practitioner guidance
- Define agents as governed identities Assign each agent an owner, a purpose and a bounded scope so delegated authority is explicit before the agent touches production systems.
- Bind tools to narrow permissions Scope each API, database and workflow connector separately instead of handing the agent broad platform-level access for convenience.
- Log goals, tool calls and outcomes together Capture the agent's goal, each tool invocation and the resulting business action in one trace so review can reconstruct behaviour end to end.
Bottom line: Agentic AI changes the problem from granting access to governing runtime decision-making across tools and workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
13/06/2026 12:01 am
Autonomy collapses the old IAM assumption that privilege can be defined at provisioning time. That assumption was designed for actors whose intent stays stable between approval and execution. It fails when the actor can reinterpret goals, choose tools and alter execution paths mid-session. The implication is that identity governance must be judged by runtime behaviour, not just by who approved access.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat autonomous agents like human users or service accounts?
A: Organisations should not treat autonomous agents as simple human analogues. They behave like governed non-human identities with added runtime decision-making, so they need identity boundaries, action checkpoints, and clear accountability. Human-style certification cycles alone are too slow for systems that can complete sensitive work within one session.
👉 Read our full editorial: Agentic AI security risks are outpacing existing IAM controls
This post was modified 3 days ago by NHI Mgmt Group