Topic starter
19/08/2026 3:43 pm
TL;DR: Agentic security failures are mostly IAM failures in disguise, according to Ory, because AI agents need scoped credentials, retrieval-layer authorization, and revocable access to tools and data. The real break point is assumption collapse: traditional IAM assumes a human-paced operator and stable permission boundaries, but agents can act, chain tools, and spread damage inside one session.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “Agentic security is an IAM problem in disguise”.
Key questions
Q: How should security teams govern AI agents that inherit authority from other identities?
A: Security teams should govern AI agents by tracking identity lineage, not just credentials.
Q: Why do agentic applications need retrieval-layer authorization?
A: Because retrieval-layer authorization limits what an agent can reach before the model acts on content.
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Practitioner guidance
- Define AI agents as governed non-human identities Assign each agent an identity, an owner, and a scoped purpose before it is allowed to interact with production tools or data.
- Move authorization to retrieval and tool boundaries Enforce which documents, APIs, and external actions each agent can reach outside the model so malicious context cannot overwrite policy.
- Replace ambient access with task-scoped credentials Issue short-lived credentials for the minimum task window and revoke them when the task ends or behaviour becomes suspicious.
Bottom line: AI agents change the failure mode from bad output to bad action, which makes identity and authorisation the primary control surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:21 pm
Agentic security becomes an IAM problem the moment an AI agent can initiate actions. Ory’s framing is correct because the control question is not whether the model is clever, but who or what is authorised to act. Once an agent can call tools, write data, or send messages, identity scope and revocation become the real security boundary. Practitioners should treat agent execution as governed access, not as model output.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams prioritise for agentic security programmes?
A: Start with issuance-time control, revocation, and clear human ownership, then add runtime containment such as egress filtering and isolation. That sequence makes agent behaviour auditable and keeps the access model aligned with how agents actually execute.
👉 Read our full editorial: Agentic security is really an IAM problem for AI agents