Topic starter
09/06/2026 11:48 pm
TL;DR: 91% of AI agents are over-privileged, 78% of AI deployments have no audit trail, and 64% of organisations cannot detect shadow AI agents, underscoring why one-time login checks do not govern agentic behaviour, according to SecureAuth. Identity programmes now need continuous authorization, attribution, and audit because autonomous action changes the control problem, not just the threat surface.
Editorial analysis by NHI Mgmt Group, based on content published by SecureAuth: “SecureAuth Launches Agent Authority Platform and Names Mark van Oppen Chief Revenue Officer to Lead the Next Era of Identity Security in the Age of AI”.
By the numbers:
- 91% of AI agents are over-privileged.
- 78% of AI deployments have no audit trail.
- 64% of organisations cannot detect shadow AI agents.
Key questions
Q: What breaks when security only checks AI agent access at session start?
A: Session-start checks miss what happens after access is granted.
Q: Why do AI agents need continuous authorization instead of one-time login checks?
A: AI agents can change behavior quickly, so a one-time authentication event does not prove the next action is still appropriate.
Q: What are the signs that an agent governance programme is failing?
A: Common signals include unknown agents in staging or production, unvetted MCP connections, broad or long-lived credentials, and logs that show service-account activity without clear ownership.
Practitioner guidance
- Define action-level authorization for agents Set policy so each API call, tool invocation, or transaction is evaluated in real time against identity and context rather than inherited from login time.
- Remove standing privileges from agent identities Replace broad agent permissions with narrowly scoped, task-bound access that can be downscoped or denied when the request changes meaning.
- Bind agent activity to human purpose Require every agent to carry a human user, business purpose, and immutable audit trail so SOC and compliance can trace decisions after the fact.
Bottom line: AI agents are creating an identity control problem that login-only checks cannot solve, because the dangerous decision often happens after authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
10/06/2026 2:18 am
Continuous authorization is the missing identity control for agentic AI. Login-time authentication assumes the security question is answered once, before the workload starts. That assumption fails when an agent can decide and act repeatedly inside the same session, because each tool call becomes a new trust decision. The implication is that identity governance for agents must be judged on transaction-level authority, not on whether the session was initially valid.
A few things that frame the scale:
- 91% of AI agents are over-privileged, according to AI Agents: The New Attack Surface report.
- Another finding from the same research shows that 78% of AI deployments have no audit trail, which leaves security teams unable to reconstruct agent action chains after the fact.
A question worth separating out:
Q: What is the difference between continuous authorization and login-time authentication for AI agents?
A: Login-time authentication confirms the identity at the start of a session, while continuous authorization decides whether each specific action should proceed. For AI agents, that distinction matters because the session can remain valid while the agent's intent, target, or risk changes. Continuous authorization is therefore the stronger control for runtime behaviour.
👉 Read our full editorial: Continuous authorization for AI agents is the new identity baseline
11/06/2026 1:18 am
Continuous authorization is the missing identity control for agentic AI. Login-time authentication assumes the security question is answered once, before the workload starts. That assumption fails when an agent can decide and act repeatedly inside the same session, because each tool call becomes a new trust decision. The implication is that identity governance for agents must be judged on transaction-level authority, not on whether the session was initially valid.
A few things that frame the scale:
- 91% of AI agents are over-privileged, according to AI Agents: The New Attack Surface report.
- Another finding from the same research shows that 78% of AI deployments have no audit trail, which leaves security teams unable to reconstruct agent action chains after the fact.
A question worth separating out:
Q: What is the difference between continuous authorization and login-time authentication for AI agents?
A: Login-time authentication confirms the identity at the start of a session, while continuous authorization decides whether each specific action should proceed. For AI agents, that distinction matters because the session can remain valid while the agent's intent, target, or risk changes. Continuous authorization is therefore the stronger control for runtime behaviour.
👉 Read our full editorial: Continuous authorization for AI agents is the new identity baseline
12/06/2026 2:53 am
Continuous authorization is the correct control boundary for AI agents. Login-time authentication is necessary, but it is no longer sufficient when the identity can continue to act, select tools, and trigger transactions after entry. The governance issue is now the action, not the session. Practitioners should treat every agent action as a policy decision point, not a byproduct of access.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations use continuous authorization instead of traditional PAM for AI agents?
A: They should use continuous authorization for agent actions and keep PAM as part of the wider identity stack. PAM controls standing privilege and escalation, but AI agents need per-action decisions because their risk changes within the session. The two controls are complementary, not interchangeable.
👉 Read our full editorial: Continuous authorization for AI agents is the new identity baseline
This post was modified 2 days ago by NHI Mgmt Group