Topic starter
06/06/2026 1:58 am
TL;DR: AI agents now operate directly in enterprise systems, but broad OAuth reuse, standing grants, and weak audit trails leave teams unable to explain or constrain agent actions, according to Oasis Security. Its agentic access model turns requests into short-lived, policy-evaluated sessions with end-to-end accountability. The governing assumption that access can be reviewed after the fact breaks when agents act within a single session.
Editorial analysis by NHI Mgmt Group, based on content published by Oasis Security: “Introducing Oasis Agentic Access Management”.
Key questions
A: Teams should treat delegated OAuth and reused human access as transitional, not final, controls.
Q: Why do standing grants create more risk for AI agents than for ordinary application workflows?
A: Standing grants create more risk because agent behaviour is task-driven and variable, while the permissions remain persistent and broad.
Q: What are the signs that an agent governance programme is failing?
A: Common signals include unknown agents in staging or production, unvetted MCP connections, broad or long-lived credentials, and logs that show service-account activity without clear ownership.
Practitioner guidance
- Map every agent access path Identify where AI agents still rely on delegated OAuth, reused human access, or inherited application permissions, then trace each path to the underlying enterprise systems and data it can reach.
- Replace standing grants with task-scoped issuance Require short-lived identities that are evaluated per request and destroyed after the task completes, so an agent cannot keep broad access between actions.
- Bind approvals to structured intent Capture the resource, operation, scope, and purpose for each agent request before permission is granted, and use that record as the basis for policy decisions and investigations.
Bottom line: AI agents become materially harder to govern when they inherit broad permissions that were never designed for task-specific execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
06/06/2026 3:22 am
Agentic access management exposes the collapse of post-hoc access review. Access review processes were built on the assumption that privilege persists long enough to be observed, recertified, and revoked. That assumption fails when an AI agent can receive, use, and discard access inside a single task. The implication is not simply more logging, but a shift in where control must sit: at issuance time, not review time.
A few things that frame the scale:
- Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
A question worth separating out:
Q: What is the difference between ephemeral agent identities and traditional access reviews?
A: Ephemeral identities govern access before and during execution, while access reviews verify access after it has already existed. For AI agents, that difference matters because the access may be created and destroyed within a single session, leaving little or nothing meaningful to recertify after the fact.
👉 Read our full editorial: Oasis Agentic Access Management reframes AI agent governance
This post was modified 4 days ago by NHI Mgmt Group