Topic starter
20/01/2026 12:57 pm
TL;DR: OWASP’s 2026 Top 10 for Agentic Applications formalises risks such as goal hijack, tool misuse, identity and privilege abuse, and rogue agents, while Descope’s article maps each risk to identity controls and runtime governance patterns. The central message is that agentic systems break traditional IAM assumptions about stable intent, static privilege, and human-paced approval.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “OWASP Agentic Top 10 and the Case for Agentic Identity”.
Key questions
Q: What breaks when agent identities inherit user permissions too broadly?
A: The main failure is that authorisation no longer matches the actor that actually decides what to do.
Q: Why do short-lived credentials matter more for agentic AI than for ordinary apps?
A: Agentic systems can request, use, and discard access inside a narrow runtime window, so long-lived credentials create unnecessary exposure between actions.
Q: Where do IAM controls fail most often with autonomous agents?
A: They fail at the boundary between approval and execution.
Practitioner guidance
- Define per-agent identities Assign each agent its own identity, separate from the user or service account that invoked it, so attribution and revocation remain precise when actions cross multiple tools and sessions.
- Scope credentials to tasks Issue short-lived tokens and API access only for the exact task, tool, and permission boundary required, then revoke them immediately after the action completes.
- Verify agent sessions before granting access Use registration and consent checks to validate agent metadata, user context, and intended session before the agent receives any credentials or begins tool use.
Bottom line: Agentic applications expose a governance gap where runtime decisions, tool use, and delegated credentials no longer fit stable IAM assumptions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
06/10/2026 6:58 pm
Access review processes were designed for privilege that persists long enough to be observed. That assumption fails when an agent can receive, use, and discard credentials within a single task or session. Traditional recertification cycles cannot certify behaviour that leaves no durable review artefact. The implication is that governance has to move closer to issuance, runtime policy, and revocation, because the review window no longer matches the execution window.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How can organisations tell whether an agent has exceeded its intended scope?
A: Organisations should look for cross-system action chains, unusual delegation hops, and high-impact actions that were never intended by the originating request. If an agent can move from read access to configuration change to deployment or export without a separate control point, its effective scope has expanded beyond what the initial entitlement suggested.
👉 Read our full editorial: OWASP agentic applications top 10 exposes identity gaps