Topic starter
15/04/2026 3:05 pm
TL;DR: Agentic AI is creating four recurring security problems for enterprises: shadow usage, data leakage, policy definition, and anomaly detection, according to Andromeda Security’s findings from more than 100 CISOs and IAM leaders. The governance gap is no longer theoretical because autonomous and delegated agents both stress privilege, lifecycle, and audit models built for human-paced access.
Editorial analysis by NHI Mgmt Group, based on content published by Andromeda Security: “Securing Agentic AI: Navigating Identity & Access in the Machine Era”.
Key questions
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
Q: Why do on-behalf-of agents create more risk than ordinary OAuth use?
A: Because the agent can search beyond the user’s intended workflow and exploit accidental over-privilege in the delegated scope.
Q: How can teams tell whether agentic access controls are actually working?
A: Look for evidence that every privileged action is logged with actor type, target resource, and policy decision, and that denied requests are being blocked before execution.
Practitioner guidance
- Map every agent to a named owner Create a lifecycle owner for each autonomous, delegated or hybrid agent so access, revocation and certification have a human accountable party.
- Replace persistent tokens with session-bound access Use short-lived delegated tokens or JIT access for agent sessions and revoke credentials automatically when the interaction ends or the task closes.
- Separate NHI identity from delegated human authority Record whether each agent action used its own service account, a user token or both, and preserve that distinction in logs and policy evaluation.
Bottom line: Agentic AI exposes a mismatch between human-centred IAM and identities that can act, choose tools and continue execution at runtime.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
06/10/2026 6:53 pm
Agentic AI breaks the assumption that privilege can be safely reasoned about at provisioning time. That assumption was designed for users and service accounts whose intent is relatively stable across a session. It fails when the actor can choose actions, combine tools and continue executing without a human gate. The implication is that identity governance has to move from entitlement snapshots to runtime authority tracking.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when a hybrid agent triggers a harmful action?
A: Accountability should sit with the human owner of the agent and the team operating the governing controls, not with the agent itself. If the workflow combines service accounts, user tokens and sub-agents, the organisation needs explicit ownership and audit mapping before it can assign responsibility.
👉 Read our full editorial: Agentic AI identity now breaks traditional IAM assumptions