Notifications
Clear all
Topic starter
26/08/2026 11:51 am
TL;DR: AI agents are being granted broad delegated access through OAuth-style trust models that were designed for static software, not runtime decision-making, according to Cakewalk’s analysis. The core failure is assumption collapse: access reviews and signup-time consent do not govern agents that act dynamically across human, agent, and system boundaries.
NHIMG editorial — based on content published by Cakewalk: Human → Agent → System: A Working Model for Governing Agent Access
Questions worth separating out
Q: What breaks when AI agents are governed like ordinary service principals?
A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns.
Q: Why do AI agents complicate privilege management for IAM teams?
A: AI agents can authenticate, call tools, and act with delegated authority, which means they behave like non-human identities with real execution power.
Q: How can security teams tell whether agent access is actually under control?
A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.
Practitioner guidance
- Map every agent grant to its human delegator Record who approved the grant, what the agent may do, and which systems it may reach.
- Replace one-time consent with per-action authorisation Evaluate each tool call at runtime against the delegating human, the requested action, and the target system.
- Separate agent tokens from agent context Store session credentials outside the model context so prompt injection or context leakage cannot directly expose reusable secrets.
What's in the full article
Cakewalk's full analysis covers the operational detail this post intentionally leaves for the source:
- The end-to-end access layer design for Human → Agent → System governance, including how delegation and accountability are bound together.
- The runtime evaluation model for per-action decisions, including how the gateway reads the human, the agent, and the target system on each call.
- The separation of agent tokens from agent context, which reduces the risk of prompt injection exposing reusable credentials.
- The implementation details behind sensitive environment variable handling and session-scoped permissions in the access gateway.
👉 Read Cakewalk's analysis of Human → Agent → System access governance →
Human, agent, and system access: what governance is missing?
Explore further
26/08/2026 11:51 am
Static OAuth consent is the wrong control for agentic access. The article shows that a single approval event cannot safely govern a software actor that makes runtime decisions, selects actions dynamically, and reuses access across changing contexts. That is not a minor implementation gap. It is an assumption failure in the consent model itself, and practitioners should stop treating agent access as ordinary third-party app access.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to SailPoint.
A question worth separating out:
Q: Who is accountable when an AI agent uses delegated access incorrectly?
A: Accountability should follow the delegated authority chain, not stop at the agent label. The relevant owners are the teams responsible for the human identity, the service identity, the workflow, and the policy that allowed the action path. If those responsibilities are not explicit, incident review will be incomplete and remediation will focus on the wrong layer.
👉 Read our full editorial: Human, agent and system: the governance gap in AI access
