Notifications
Clear all
Topic starter
22/07/2026 4:36 pm
TL;DR: Multi-agent systems challenge static IAM and PAM models by planning, calling tools, and delegating work at runtime, which creates non-linear chains of custody and weak accountability, according to Apono. Standing access becomes the wrong default when authority can change mid-task and persist longer than the action itself.
NHIMG editorial — based on content published by Apono: Are Multi-Agent Systems the Next Frontier for Identity Security?
By the numbers:
- Within the next three years, 82% of executives plan to adopt AI agents, while noting that the gap between experimentation and mature oversight is widening.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams implement task-scoped access for multi-agent systems?
A: Start by mapping each sensitive agent action to a specific resource, approval condition, and expiry rule.
Q: Why do multi-agent systems make accountability harder than traditional automation?
A: Because the action path can change at runtime.
Q: What breaks when standing privilege is not removed for privileged users and service accounts?
A: Standing privilege breaks the assumption that access is only available when needed.
Practitioner guidance
- Map agent delegation chains Inventory which human, workflow, or agent can trigger downstream actions, and record which tools or APIs each path can reach.
- Convert standing privileges to task-scoped access Replace persistent agent permissions with just-in-time access that expires when the task ends or the approval window closes.
- Require provenance for every sensitive action Log the initiating context, the performing agent, the tools used, the permissions granted, and whether approval was required before execution.
What's in the full article
Apono's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor frames task-scoped, time-bound access for multi-agent workflows in production environments.
- The specific control model it proposes for zero standing privilege across human, machine, and agentic identities.
- Examples of how it maps approval, duration, and resource sensitivity into runtime authorization decisions.
- The vendor's own framing of runtime privilege controls for agent workflows and auditability.
👉 Read Apono's analysis of multi-agent systems and identity security →
Multi-agent systems and standing privilege: are IAM controls keeping up?
Explore further
22/07/2026 4:42 pm
Standing access was designed for actors whose authority is stable long enough to be reviewed. That assumption fails when multi-agent systems can plan, delegate, and invoke tools at runtime because the access path is no longer fixed at provisioning. The implication is not just that controls need tightening. It is that the review model itself stops matching how authority is exercised.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- A separate finding from the same research shows that 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
A question worth separating out:
Q: Who should approve high-risk actions in agentic workflows?
A: The approval model should be tied to the action, not to the existence of the agent. High-risk, destructive, or cross-environment actions need explicit human approval before execution, even when the surrounding workflow is automated. That keeps delegated authority from becoming unchecked execution authority.
👉 Read our full editorial: Multi-agent systems are exposing IAM assumptions about standing access
