Notifications
Clear all
Topic starter
19/08/2026 3:43 pm
TL;DR: Agentic security failures are mostly IAM failures in disguise, according to Ory, because AI agents need scoped credentials, retrieval-layer authorization, and revocable access to tools and data. The real break point is assumption collapse: traditional IAM assumes a human-paced operator and stable permission boundaries, but agents can act, chain tools, and spread damage inside one session.
NHIMG editorial — based on content published by Ory: Agentic security is an IAM problem in disguise
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should organizations approach the governance of AI agents?
A: Organizations should adopt a governance framework that incorporates continuous visibility, adaptive IAM practices, and stringent policy-based controls.
Q: Why do AI agents complicate least privilege in IAM programmes?
A: AI agents complicate least privilege because their useful scope is often broader than a traditional service account, but their actual authority should still be narrower at each action.
Q: What breaks when retrieval permissions are not separated from execution permissions?
A: A compromised agent can use the same access path to discover content and then act on it, which expands blast radius fast.
Practitioner guidance
- Treat agents as governed non-human identities Assign each agent a unique identity, explicit owner, minimum permissions, and a revocation path.
- Separate retrieval trust from execution trust Apply access controls to the documents, APIs, and tools an agent can retrieve, then enforce a second boundary on what it can call, send, or write.
- Use short-lived credentials for agent-to-agent and tool access Replace static shared secrets with short-lived tokens or federated credentials so a compromised agent cannot reuse the same access across sessions or systems.
What's in the full article
Ory's full blog post covers the operational detail this post intentionally leaves for the source:
- Token issuance and revocation patterns for agent identities across tools and APIs
- The hierarchical agent permission model with orchestrators, planners, and executors
- How Ory Hydra supports OAuth-based access control for agent workflows
- Where ReBAC-style permissioning fits when agents need delegated access across systems
👉 Read Ory's analysis of agentic security as an IAM problem →
AI agent identity and access control: what IAM teams must fix?
Explore further
19/08/2026 4:21 pm
Agentic security is an IAM problem because the control surface is identity, not the prompt. The article correctly frames the shift from text safety to action safety. Once an AI system can fetch content, call tools, and communicate externally, the governance question becomes who or what is allowed to do those things. That is an IAM question with execution consequences, and practitioners should treat agent authorization as part of the identity control plane.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to the 2026 Infrastructure Identity Survey.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do organisations keep accountability when agents act on behalf of users?
A: They need a provenance model that links the user, the agent, the tool call, and the runtime decision together. Without that chain, audit records show that something happened but not who effectively authorised it or why. Accountability depends on preserving context through the full delegated workflow.
👉 Read our full editorial: Agentic security is really an IAM problem for AI agents
