Intent passports for AI agents: are your controls keeping up?

NHI Mgmt Group · 2026-06-11T00:12:41+00:00

TL;DR: As AI agents act continuously across data, decisions and customer journeys, identity alone no longer describes what they are authorised to do; Gathid argues for an intent passport that binds purpose, scope, time and logging to behaviour. The missing control is not another role but a governance model for machine action. Editorial analysis by NHI Mgmt Group, based on content published by Gathid: “Intent Is The New Identity: Why CMOs Must Lead The Next Era Of AI Governance”. Key questions Q: What breaks when directory identity is treated as enough for AI agent authorisation? A: Directory identity breaks as a governance boundary when teams assume registration and standing scopes are sufficient for dynamic agent behaviour. Q: Why do AI agents need intent-based authorization instead of role-only access? A: Role-only access answers who the actor is, but not whether the action still matches the reason access was granted. Q: How do security teams know whether agent permissions are still valid? A: They should look for expiry, logging and revocation tied to the original task. Practitioner guidance Define intent-bound authorisation for agent workflows Map each high-impact agent use case to a declared purpose, data scope, time window and escalation condition before it is allowed to run. Make logging the accountability layer Require traceable decision trails for every customer-facing or spend-influencing agent so teams can reconstruct what happened and why. Set automatic expiry on agent permissions Treat every intent passport as temporary and withdraw access when the task ends, the context changes or the risk level increases. Bottom line: AI agent governance fails when organisations treat identity as the full authorisation model instead of a starting point for control. Explore furtherView Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →

Topic starter 12/06/2026 6:07 am

Intent is the missing control plane for AI agents: identity tells us who the actor is, but not what the actor is authorised to do in the moment. That matters because agentic systems can consume signals, choose actions and continue operating after the initial task context has changed. Practitioners should treat intent as a first-class governance object, not a policy footnote.

A few things that frame the scale:

54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.

A question worth separating out:

Q: What is the difference between an AI agent’s identity and its intent passport?

A: Identity identifies the actor. An intent passport defines the actor’s authorised behaviour, including purpose, data scope, time window, risk level and revocation rules. One answers who is acting, while the other answers what that actor may do, under what conditions and for how long. They solve different governance problems.

👉 Read our full editorial: Intent passports for AI agents: what identity alone misses

Intent passports for AI agents: are your controls keeping up?

Deepen Your Knowledge

Subscribe to the NHI & AI Identity Journal

Subscribe to the NHI & AI Identity Journal