Notifications
Clear all
Topic starter
24/06/2026 7:16 pm
TL;DR: Know Your Agent (KYA) shifts AI agent governance from registration-time checks to runtime authentication and authorization, tying consequential actions to a verified human owner and a cryptographic audit trail, according to 1Kosmos. The core issue is assumption collapse: traditional IAM assumes access can be validated once and remain stable, but autonomous agents decide and act at execution time.
NHIMG editorial — based on content published by 1Kosmos: Know Your Agent, runtime identity, and AI agent authorization
Questions worth separating out
Q: How should security teams govern AI agents that can make runtime decisions?
A: Security teams should govern AI agents at the moment of execution, not only at registration.
Q: Why do autonomous agents break traditional NHI controls?
A: Autonomous agents break traditional NHI controls because they do not follow a fixed script.
Q: What is the main failure mode when AI agent credentials are too broad?
A: The main failure mode is scope drift, where the agent discovers or inherits authority beyond the task it was meant to perform.
Practitioner guidance
- Map which agent actions require runtime approval Classify agent operations by consequence, not by workload type.
- Replace persistent agent secrets with time-bound credentials Eliminate long-lived API keys for AI agents where possible and issue scoped credentials with explicit expiry, issuer attribution, and environment constraints.
- Bind each agent to a named human owner Require every production agent to have a current accountable owner and an offboarding path.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- The runtime authorization flow at the MCP layer, including how the policy engine intercepts tool calls before execution.
- The credential structure for verifiable credentials, including issuer identity, environmental context, and validity windows.
- The step-up approval flow for high-risk agent actions, including biometric verification and approval logging.
- The incident examples and product-specific implementation details that show how the model is applied in practice.
👉 Read 1Kosmos's analysis of Know Your Agent and runtime AI identity controls →
Runtime identity for AI agents: what changes for governance?
Explore further
25/06/2026 4:29 am
Know Your Agent is an execution-plane response to a broken IAM assumption. Traditional identity governance was designed for access that is granted, then reviewed later. That assumption fails when the actor is autonomous because the agent decides which tool to use and when to use it only at runtime. The implication is that registration-time identity checks no longer describe the actual risk surface.
A few things that frame the scale:
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who should be accountable when an AI agent takes an unauthorised action?
A: Accountability should sit with the human owner who authorised the agent and the controls that allowed the action to proceed. If the organisation cannot identify who issued the credential, what scope was granted, and whether approval was required, then the governance model is too weak for agentic operations. Accountability must be built into the identity chain.
👉 Read our full editorial: Know Your Agent makes runtime identity the control plane for AI
