Topic starter
23/06/2026 7:25 pm
TL;DR: Scoped tokens reduce blast radius for AI agents but do not decide whether a specific action should execute in the moment, according to PermitIO, because token scope is admission rather than authorization. Runtime policy, delegated intent, and live context must control each tool call.
Editorial analysis by NHI Mgmt Group, based on content published by PermitIO: “Agent Identity vs. Service Accounts: Why Scoped Tokens Still Need Runtime Authorization”.
Key questions
Q: What is the difference between runtime observability and authorisation for AI agents?
A: Runtime observability shows what the agent did or attempted, while authorisation decides whether it should have been allowed to do it at all.
Q: Why do scoped credentials still need per-call policy checks?
A: Scoped credentials limit exposure, but they do not judge whether the current action is appropriate.
Q: What breaks when AI agents are governed like ordinary service principals?
A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns.
Practitioner guidance
- Define per-call authorisation boundaries Require every sensitive tool invocation to pass a live policy check that uses the current task, trust state, and requested resource, not just the original token scope.
- Record the full delegation chain Log the delegating user, agent principal, session identifier, task class, requested action, and policy decision so that runtime decisions are attributable after the fact.
- Separate authentication from authorisation Use scoped credentials for admission and machine authentication, but make execution contingent on a second decision layer that can deny an otherwise valid token in context.
Bottom line: Scoped tokens limit what an AI agent can start with, but they do not determine whether a specific action is appropriate at execution time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:24 am
Scoped tokens are an admission control, not an execution control, for AI agents. PermitIO's analysis is strongest where it separates starting authority from action authority. That distinction matters because agents do not simply authenticate and run a fixed path; they make runtime decisions that can be valid syntactically and still wrong operationally. Practitioners should treat token scope as necessary but insufficient.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can organisations make AI agent actions auditable?
A: Organisations need logs that connect each action to a specific agent identity, the delegator, the purpose, the tokens used, and the downstream systems touched. Auditability should cover the entire delegation chain, not just the final API call. If the record stops at the application layer, it will not support compliance, incident response, or accountability.
👉 Read our full editorial: Scoped tokens are not enough for AI agent runtime authorization