Notifications
Clear all
Topic starter
30/07/2026 10:50 pm
TL;DR: Agentic systems can be talked into unsafe actions through prompt injection, and Unosecur argues that Model Context Protocol improvements and gateway controls do not solve the core problem if authorization is based on declared intent rather than bounded tasks. The decisive control is task-based authorization with short-lived, scope-specific access.
NHIMG editorial — based on content published by Unosecur: Authorize the task, not the intent
By the numbers:
- Gartner expects that through 2029, more than half of all successful attacks on AI agents will come through access control, not through anything clever done to the model.
- OWASP's 2026 top ten for agentic applications opens at number one with Agent Goal Hijack.
Questions worth separating out
Q: What should security teams do when an AI agent's declared intent changes during a session?
A: They should treat the intent change as an indicator, not an authorization trigger.
Q: Why do AI agents complicate traditional IAM and PAM controls?
A: AI agents complicate IAM and PAM because they can make decisions, chain tools, and act faster than human review cycles can respond.
Q: What breaks when agent tool access is not mediated through a gateway?
A: Tool exposure becomes a flat capability set instead of a bounded decision surface.
Practitioner guidance
- Define task-scoped credential boundaries Map each agent use case to a bounded work unit, then issue credentials only for that unit and its approved tools.
- Separate routing signals from authorization decisions Use declared intent to route requests to the correct task template, but never to grant access.
- Add bypass detection to the identity fabric Correlate gateway logs, direct tool calls, and standalone token use so that traffic bypassing the approved control plane becomes visible.
What's in the full article
Unosecur's full analysis covers the operational detail this post intentionally leaves for the source:
- The MCP Auth Gateway control model and how it enforces task-scoped permissions at runtime
- The vendor's implementation view of just-in-time approvals, credential expiry, and kill-switch handling
- The architecture pattern for detecting agents or users who bypass the gateway and call tools directly
- The article's examples of how task templates, scoped credentials, and audit records fit together in practice
👉 Read Unosecur's analysis of task-based authorization for AI agents →
AI agent intent is not a control, so what should teams enforce?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
30/07/2026 10:57 pm
Task-based authorization is the right mental model for AI agents because declared intent is not a stable security boundary. When an agent can read arbitrary text and update its working objective mid-session, the authorization question is no longer who asked, but what work the credential was bound to. That makes least privilege a property of task scope, not of conversation quality. Practitioners should treat any intent-driven access model as incomplete governance.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when an AI agent accesses the wrong data?
A: Accountability sits with the team that defined the agent’s scope, the owner of the delegated user context, and the operators who allowed access to persist beyond the task. For customer workflows, audit logs should show both the agent and the user identity so responsibility can be traced clearly.
👉 Read our full editorial: Task-based authorization is the missing control for AI agents
