Topic starter
16/04/2026 12:58 pm
TL;DR: AI agents need access decisions at every step, not just at login, because they chain actions across systems and act on behalf of others, according to Curity. The governance shift is from static authentication to continuous, task-scoped authorization with approval for high-risk actions.
Editorial analysis by NHI Mgmt Group, based on content published by Curity: “Curity Launches Access Intelligence for Real-Time AI Agent Authorization”.
Key questions
Q: How should security teams separate AI agent access control from runtime action authorization?
A: Treat them as two different control planes.
Q: Why do AI agents need continuous authorization instead of one-time login checks?
A: AI agents can change behavior quickly, so a one-time authentication event does not prove the next action is still appropriate.
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Practitioner guidance
- Map agent workflows to step-level authorization checkpoints Identify where an AI agent makes sequential decisions, then require runtime evaluation at each API call or tool invocation instead of trusting the initial login event.
- Issue ephemeral, task-scoped credentials Replace standing agent credentials with single-interaction access that expires with the task and carries the represented principal and allowed action in the token.
- Define approval gates for high-risk actions Classify agent actions that can affect money, data changes, external communications or irreversible state, and require human confirmation before those steps execute.
Bottom line: AI agents create an access problem that authentication alone does not solve, because the real risk appears while the workflow is in motion.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:54 pm
Runtime authorisation is the correct control plane for AI agents because the trust decision now happens during execution, not before it. Authentication proves entry, but it does not constrain what a chained workflow can do after the first request. The field needs to stop treating login as the main security boundary when the actor can continue making decisions inside the session. Practitioners should design for decision-time enforcement, not just identity proofing.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations require human approval for an AI agent action?
A: Require human approval when the action could change infrastructure, expose sensitive data, move laterally across systems, or trigger a business-critical workflow that is hard to reverse. Approval is also warranted when the agent’s decision depends on ambiguous input or external data that cannot be trusted at face value. High-consequence actions need a human stop point.
👉 Read our full editorial: Runtime authorization for AI agents: what access intelligence changes