Notifications
Clear all
Topic starter
24/07/2026 4:08 pm
TL;DR: AI agents connected through MCP are often being granted production access with long-lived credentials, yet 80% of organisations report agents have already acted beyond intended scope, according to SailPoint. The real issue is not authentication alone: runtime authorisation and intent-aware policy now decide whether agent sessions stay governable or become destructive.
NHIMG editorial — what this means for AI and NHI governance
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
Questions worth separating out
Q: How should security teams govern AI agents that use service accounts and MCP tools?
A: Start with ownership, then add runtime attribution and containment.
Q: Why do valid credentials still fail to protect against AI agent mistakes?
A: Because a valid credential only proves the system recognised the identity.
Q: What do teams get wrong about AI agent access reviews?
A: Teams often assume an access review can certify an agent the same way they certify a human or a service account.
Practitioner guidance
- Remove agent-visible long-lived secrets Audit MCP configuration files, environment variables, and adjacent toolchains for passwords, tokens, API keys, and certificates that an AI agent can read or inherit.
- Require policy checks at action time Insert runtime authorisation before database writes, destructive shell commands, cloud API calls, and SaaS updates so each request is evaluated against purpose, scope, and destination.
- Constrain agents to just-in-time access Use per-action or per-task credentials with immediate expiry after execution completes, especially for production databases, SSH, Kubernetes, and cloud services.
What's in the full announcement
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step walkthrough of the Gateway-mediated access flow across Claude Chat, Cowork, and Claude Code.
- Specific examples of how just-in-time credential injection works for databases, Kubernetes, SSH, and cloud APIs.
- Implementation details for keeping credentials outside the model context while preserving forensic traceability.
- How the Compliance API integrates with runtime policy enforcement in practice.
👉 Read Akeyless's analysis of runtime access control for AI agents in Claude Enterprise →
AI agent access in Claude Enterprise: what changes for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
24/07/2026 4:13 pm
Standing credentials are the wrong mental model for agent identity. AI agents connected through MCP behave less like ordinary service accounts and more like runtime decision systems that can choose actions after access is granted. That means persistent credentials create both exposure and governance drift, because the session can continue long after the original trust decision has gone stale. The practitioner conclusion is that agent identity must be treated as an action-bearing session, not a static login.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface.
- 48% of organisations say they cannot fully track and audit the data their AI agents access, which leaves a compliance and investigation blind spot that is already operational.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unsafe action?
A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.
👉 Read our full editorial: Runtime access control for AI agents in Claude Enterprise
