Topic starter
21/08/2025 3:53 pm
TL;DR: Agentic AI systems act with autonomy, persistent context, and delegated authority, which means every action depends on authenticated credentials, policy checks, and auditability across the agent lifecycle, according to Okta's analysis. Static, human-centric IAM models do not adequately cover non-human identities that can plan, delegate, and act at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “What is agentic AI? Securing autonomous agents”.
Key questions
Q: How should security teams govern AI agents that browse and transact on behalf of users?
A: Security teams should govern AI agents as delegated actors with narrow, task-scoped permissions, not as enhanced browsers.
Q: Why do autonomous AI systems create more identity risk than normal automation?
A: Normal automation follows a fixed path, but autonomous systems can interpret goals, choose actions, and continue without waiting for a person.
Q: What breaks when agent memory and credentials are managed separately?
A: The agent can retain context that still implies authority even after the original permission should have expired.
Practitioner guidance
- Define agent-specific authorization boundaries Map every AI agent to a distinct identity, then constrain its tools, data sources, and action scope to the minimum required for each workflow.
- Move approval from session start to action time Use runtime policy checks for each high-risk step so an agent cannot carry over broad permissions from one task to another.
- Separate agent memory from standing privilege Keep persistent context, secrets, and authorization state in governed stores with explicit retention and revocation rules.
Bottom line: Agentic AI introduces a governance problem where identity decisions must be enforced during execution, not only at login or provisioning.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:40 pm
Agentic AI turns identity into an execution substrate, not just an access gate. The important shift is that the agent is not merely authenticating before use, it is making runtime choices through delegated authority. That means identity governance must move from static entitlement review to continuous control over tool access, action scope, and delegation boundaries. Practitioners should treat every agent action as an identity event with policy significance.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams do to keep agent actions auditable?
A: Record who initiated the agent, what authority it received, which policy approved each step, and what external system it touched. That evidence chain is what makes a later investigation possible when an agent behaves outside expectation.
👉 Read our full editorial: Agentic AI governance needs dynamic identity controls, not static IAM