NHI & Agentic AI Identity Security FAQ

Question 1

Why do consumer accounts need different IAM controls from workforce identities?

Accepted Answer

Consumer identities operate at much larger scale, with higher volatility, more self-service, and far less direct administrator oversight. That changes the control model. B2C CIAM has to handle registration, consent, social login, and account recovery in ways that support customer journeys while still resisting fraud and takeover attempts.

Question 2

Why do online portals matter so much in customer identity programmes?

Accepted Answer

Portals are where customers experience whether identity design actually works. If access, recovery, and session handling are clumsy, users often read that as a lack of reliability or control. Strong portal design improves service confidence because it gives customers a clear, repeatable way to view and manage their own data.

Question 3

How can practitioners tell whether their team is reading deeply enough?

Accepted Answer

A useful test is whether the team can explain the mechanism, the assumptions, and the limits of a recommendation in its own words. If it cannot, the team is probably consuming information faster than it is understanding it.

Question 4

Why does Active Directory still matter to modern identity programmes?

Accepted Answer

Active Directory still matters because it often acts as the authoritative control plane for authentication, group-based authorisation, and privileged administration. When directory trust is centralised, its availability and integrity affect user access, service accounts, and recovery operations across the enterprise. Identity teams should treat it as core security infrastructure, not an ageing back-office service.

Question 5

What breaks when purchases and identity are not unified across channels?

Accepted Answer

When purchases and identity are not unified, users can buy value on one channel and fail to see it on another, which looks like fraud or product failure from their perspective. Support teams then inherit the inconsistency, and trust drops quickly. Unified identity is what keeps entitlements recognisable across devices.

Question 6

Why do customer identities need different controls from workforce identities?

Accepted Answer

Customer identities behave at much larger scale and under far less organisational context than workforce identities. That changes recovery, assurance, privacy, and user-experience requirements. A control that works for an employee can create abandonment or compliance issues for a customer, so the design must reflect the identity subject and the business outcome.

Question 7

Why do RAG systems need more than a single quality score?

Accepted Answer

A single score can hide whether the retriever failed, the generator hallucinated, or the answer was correct but poorly explained. Separate signals for grounding, relevance, and retrieval quality help teams identify the real problem and avoid fixing the wrong layer of the pipeline.

Question 8

Why does contractor access often outlive the business need that created it?

Accepted Answer

Because offboarding is usually manual, fragmented, and dependent on someone remembering every system the contractor touched. When identity records, vendor management, and application accounts are not linked, access survives the contract. The result is standing privilege that no longer matches the work being performed.

Question 9

What do teams get wrong about secrets in AI-built apps?

Accepted Answer

They treat secrets as configuration details instead of privileged identities with lifecycles. If a token, API key, or certificate leaks into code, logs, or a repository, the response should include rotation, revocation, and scope review. Waiting for a later cleanup leaves the exposure window open.

Question 10

When does secret rotation stop being a meaningful PAM control?

Accepted Answer

Rotation stops being meaningful when the credential lifetime is far longer than the workload lifetime or when the same secret is reused across multiple services. In those cases, the exposure window remains open even if the rotation policy looks healthy on paper. The better measure is whether the credential still needs to exist at all.

Question 11

When does dynamic credential use justify higher transaction volume?

Accepted Answer

When the extra activity reflects shorter credential exposure rather than repeated polling. If the system issues temporary credentials at the moment of use and the TTL is aligned to the task, higher volume is a control outcome, not waste. If the same secret is being retrieved repeatedly for no runtime reason, the application design should be rechecked.

Question 12

What is the difference between lifecycle automation and simple account provisioning?

Accepted Answer

Account provisioning only adds access at the start. Lifecycle automation governs the full identity journey, including role changes, entitlement removal, offboarding, and post-departure verification. That broader scope is what prevents permission creep and proves that access no longer exists when the business relationship ends.

Question 13

Why do AI-driven attacks change the value of secrets management?

Accepted Answer

Because attack windows can shrink from days to minutes. If exposed secrets are discovered and abused faster than rotation and revocation can happen, then secrets management becomes a race against machine-speed exploitation rather than a routine hygiene task. That makes inventory, rotation, and detection all equally important.

Question 14

What breaks when secrets are left inside generated code?

Accepted Answer

Hardcoded secrets turn code into a credential repository, which expands exposure through source control, logs, build systems, and copied templates. Once a secret is embedded, rotation becomes harder and discovery often lags compromise. The better model is runtime retrieval from a managed secret store with scoped access.

Question 15

How do IAM teams know whether Firebase custom token use is expanding blast radius?

Accepted Answer

Check whether one authenticated session unlocks several Firebase services with the same trust decision. If Firestore, Storage, Realtime Database, and callable functions all accept the session, the blast radius is broader than the login screen suggests. Scope review has to include downstream service access, not just authentication success.

Question 16

How can security teams test whether token-based sign-in is actually safe?

Accepted Answer

Test the full path end to end, from token minting through session creation to protected resource access. Confirm expiry behaves as expected, the token is not persisted unnecessarily, and every downstream service enforces the same identity and access assumptions.

Question 17

Should organisations prefer native passkey flows over browser-based sign-in for mobile apps?

Accepted Answer

Native flows can improve usability and reduce browser friction, but they do not remove identity governance responsibilities. The decision should hinge on whether the organisation can secure token issuance, protect client callbacks, and govern the service account that bridges the two systems. Usability gains are only acceptable when control ownership is clear.

Question 18

How should teams govern external token exchange in mobile apps?

Accepted Answer

Treat external token exchange as a federation pattern with its own trust boundary. Define who can mint tokens, how long they live, where they can be stored, and which downstream services accept them. Then validate that authorization remains consistent when the same identity is used across Auth, data stores, and backend functions.

Question 19

What breaks when the external subject does not match the Firebase UID?

Accepted Answer

Authorization becomes inconsistent. The app may log the user in successfully, but Firestore rules, Storage rules, and other Firebase services can point at a different identity namespace, which creates access drift, broken data isolation, or overbroad document access.

Question 20

What breaks when OAuth consent is writable by too many identities?

Accepted Answer

Consent becomes a privilege-escalation path instead of an administrative exception. If too many identities can grant or modify permissions, one compromised account can create organisation-wide delegated access, hide persistence inside a legitimate application, and bypass ordinary revocation workflows. That is why consent write access must be governed like privileged control, not routine app management.

Question 21

Why do service principals with app-only permissions increase tenant risk?

Accepted Answer

Because app-only permissions let the application act as itself, not as a user. Once an attacker adds high-privilege app permissions, the app can read and modify directory objects, create new service principals, and keep working even if the original human account is disabled. The access surface is broader and more durable than a user token.

Question 22

How should security teams tell true JIT access from time-limited access?

Accepted Answer

True JIT creates privilege at the moment of need and destroys it when the task ends. Time-limited access often only shortens the use window for permissions that already exist. If a role, token, or password remains valid when no work is happening, the model is still carrying standing privilege.

Question 23

Why do vaulted credentials still create risk in privileged access programs?

Accepted Answer

Vaults improve secret custody, but they do not eliminate the permission itself. If the identity can still authenticate to a target system outside the task, the attack surface still exists. The security question is not where the credential is stored, but whether privilege survives between executions.

Question 24

When does approval-based access still leave too much privilege in place?

Accepted Answer

Approval workflows are insufficient when they only gate access checkout and do not remove the underlying entitlement from the target system. If the same permission can be reused later without a fresh runtime decision, the control reduces friction but not standing access. That is a governance gap, not true JIT.

Question 25

What should security teams do when remediation is part of the detection workflow?

Accepted Answer

They should separate detection, approval, validation, and ownership so each step is accountable. The remediation tool can assist with explanation and execution, but the identity or cloud team must decide which changes are allowed, which are logged, and where the corrected configuration is stored for future reviews.

Question 26

Why do administrator-level IAM user policies create disproportionate risk?

Accepted Answer

Administrator policies on user accounts collapse least privilege because one credential can inherit broad control over cloud resources. If that credential is exposed or misused, the blast radius is immediate and wide. In practice, direct admin attachment is a governance defect because it bypasses scoped role design and task-based elevation.

Question 27

How do teams know a remediation workflow actually fixed the issue?

Accepted Answer

Teams should verify the same control again after the change and confirm the finding moved to a passing state. They should also persist the correction in infrastructure-as-code so the secure state survives redeployment. Validation without persistence only proves the fix existed briefly, not that it is durable.

Question 28

What breaks when cloud remediation changes are applied without approval?

Accepted Answer

Without approval, remediation becomes an uncontrolled change path instead of a governed one. That creates audit problems, increases the chance of unintended service disruption, and weakens accountability for IAM or policy changes. A human approval gate keeps the operator responsible for the exact delta being applied and preserves traceability across the workflow.

Question 29

What is the difference between approval built into authorization and manual review after the fact?

Accepted Answer

Approval built into authorization blocks credential issuance until the checkpoint is passed, so the action never starts without consent. Manual review after the fact only tells you what happened, which may be too late when the action is privileged, irreversible, or time-sensitive.

Question 30

Who is responsible for revoking over-scoped MCP credentials?

Accepted Answer

The owning security and identity function must treat MCP credentials like any other governed NHI asset. That means explicit ownership, fast revocation, and lifecycle review. If revocation depends on a transport session ending, the control is already too weak for stateless requests.

Question 31

How should security teams prove that access policy is actually enforced?

Accepted Answer

They should require evidence that each request was checked against policy rules, reviewed with the right context and either approved, denied or remediated in a traceable workflow. The key test is whether the control shows effective privileges and conflict outcomes, not just that the policy exists on paper.

Question 32

Why do role-based models break down in complex enterprises?

Accepted Answer

Role-based models break down when role names no longer describe the actual access underneath them. Copying, privilege creep and local exceptions produce broad or inconsistent entitlements that reviewers cannot interpret safely. The result is role proliferation, hidden SoD conflict and weak assurance.

Question 33

What should organisations do when access spans multiple systems and business units?

Accepted Answer

They should govern access at the entitlement and process level, then apply the same policy across systems, entities and approval paths. That approach lets teams compare cross-system combinations, apply consistent risk thresholds and keep exceptions visible when access changes outside one central platform.

Question 34

How do IGA teams know whether their programme is producing real control value?

Accepted Answer

They know it is working when fewer risky combinations reach production, access reviews show effective privileges, exceptions are closed or accepted with a mitigation, and audit evidence is generated automatically from the workflow. If the programme only counts certifications completed, it is measuring activity rather than control.

Question 35

Who is accountable when acquired systems stay outside identity governance?

Accepted Answer

IAM, IGA and compliance owners are accountable for the gap until the acquired estate is brought under policy and evidence controls. If governance lags behind business change, the organisation inherits access risk, control exceptions and audit exposure at the same time.

Question 36

What breaks when a mobile app depends on a privileged service account to mint backend tokens?

Accepted Answer

If that service account is exposed, an attacker can mint valid sessions without using the intended user journey. The app may still look normal, but the trust chain is broken at the signing step. That is why the signing credential must be governed as a high-value non-human identity.

Question 37

What breaks when credential abuse is no longer the first step in a breach?

Accepted Answer

Security teams can over-focus on initial access and miss the identity abuse that actually drives persistence and exfiltration. When attackers enter through a vulnerability or pretext, they often still rely on stolen credentials, OAuth tokens, or service accounts to move laterally. The result is a false sense of progress if only login controls improve.

Question 38

Why do AI agents increase the blast radius of SaaS compromises?

Accepted Answer

AI agents increase blast radius because they often inherit broad delegated permissions and can execute many actions across connected applications in a short time. If one agent or integration is compromised, the attacker can reuse that trust to reach multiple systems, move data quickly, and escalate from one app to an ecosystem.

Question 39

Who is accountable when an MCP client exposes tokens or executes hostile input?

Accepted Answer

Accountability sits across the application team, the identity team, and the platform owner because the failure spans protocol handling, endpoint policy, and local runtime behaviour. NIST zero trust and application security controls both apply, but neither replaces the need for client-side authorization governance.

Question 40

What breaks when URL schemes are not restricted in agent clients?

Accepted Answer

Untrusted schemes can move a workflow from normal login into command injection, local file execution, XSS, or token theft. Once the client accepts arbitrary schemes, the attacker no longer needs direct server compromise. They only need the client to interpret their URL as something executable or scriptable.

Question 41

Why do long-lived tokens increase risk in cloud data platforms?

Accepted Answer

Because they extend the time between issuance and misuse. If a token remains valid across jobs, tools, and users, one exposure can reach many systems before anyone notices. The longer the credential persists, the larger the blast radius and the harder it is to prove which actions were legitimate.

Question 42

What accountability exists when an AI agent misuses enterprise access?

Accepted Answer

Accountability sits with the organisation that granted the access, defined the workflow, and accepted the control gaps. Risk, security, and system owners should jointly document who approved the permissions, which controls limit the agent, and what evidence shows those controls were tested before production use.

Question 43

How do security teams prove accountability for agent actions through MCP?

Accepted Answer

They need structured audit records that tie each tool invocation back to the human who exercised the authority, along with the tool name, parameters, server, and policy decision. Without that chain, review teams cannot reconstruct what happened or who authorised it.

Question 44

What breaks when delegated access is not visible at the resource boundary?

Accepted Answer

Auditability breaks first, followed by policy enforcement. If the resource cannot see which agent acted, who it represented, and what scope was requested, reviewers cannot reliably explain or contain the action later. That gap makes incident response and access review much weaker than the authentication flow appears to suggest.

Question 45

What breaks when organisations rely on packet controls for MCP governance?

Accepted Answer

Packet controls can see transport, but they cannot evaluate tool semantics, intent, or the delegation chain behind an agent action. As a result, they miss shadow connections, cannot distinguish legitimate from risky tool sequences, and leave audit evidence too thin for compliance or incident review.

Question 46

Why do AI agents complicate OAuth and OIDC-based access models?

Accepted Answer

Because those models were built around user sessions, not software entities that can request, combine, and act on delegated permissions. When the agent and the human are separate actors, the policy engine must understand both identities and the action being authorised, otherwise access becomes overpermissive or opaque.

Question 47

How should security teams implement approval controls for AI assistants?

Accepted Answer

Place the approval control at the point of execution, not just at login or onboarding. The assistant should wait for an explicit human confirm step before acting on any prompt that arrived through an external or indirect channel. That gives governance a verifiable decision point instead of assuming the prompt was safe because the session was legitimate.

Question 48

What breaks when an AI assistant accepts instructions before a human reviews them?

Accepted Answer

The approval model breaks, because the system can no longer prove that the instruction was user-authored or user-approved. That creates a trust gap between what the human intended and what the assistant executed. In practice, hidden or pre-filled prompt content can drive data exposure or tool use without a genuine consent step.

Question 49

How should security teams govern MCP requests without relying on session state?

Accepted Answer

Treat each MCP request as a standalone identity event. That means binding authorization to the credential, token scope, and actor claims rather than to conversation history. Teams should assume the connection may change, the server instance may change, and the identity decision must still be verifiable on every call.

Question 50

How should security teams use device intelligence in fraud prevention without overblocking users?

Accepted Answer

Use device intelligence as one input to risk-based decisions, not as a sole proof of identity. Correlate browser, network, proxy, and tampering signals with authentication context, then reserve blocking for combinations that show strong abuse patterns. That approach reduces false positives while still catching automation, infrastructure masking, and suspicious session behaviour.

Question 51

Who is accountable when webview-based identity checks fail?

Accepted Answer

Accountability usually spans product, fraud, identity, and security teams because webviews sit between customer experience and assurance controls. Organisations should assign ownership for session continuity, device risk policy, and KYC outcomes separately, then require a single decision path for high-risk flows so failures do not get lost between teams.

Question 52

What breaks when embedded browsers do not preserve session state?

Accepted Answer

When embedded browsers isolate cookies and local storage, teams lose reliable continuity across app, partner, and browser contexts. That leads to repeated logins, abandoned onboarding, weak attribution, and blind spots in fraud detection. The operational failure is not only user frustration. It is the loss of a trustworthy link between a person, a device, and a journey.

Question 53

How do teams know whether visitor recognition is working in webviews?

Accepted Answer

Measure whether returning users are correctly linked across app reinstalls, embedded browser restarts, and partner handoffs without creating excessive false positives. The real test is whether the business can restore continuity for legitimate users while still flagging suspicious device changes, spoofing attempts, and abnormal session resets.

Question 54

Why do embedded browsers increase fraud risk in mobile flows?

Accepted Answer

Embedded browsers make it easier for attackers to clear state, switch contexts, or use manipulated devices while still moving through valuable flows such as onboarding, checkout, or promotions. Because the session boundary is weaker, fraud signals that depend on browser persistence are easier to evade, especially when controls are not paired with device intelligence.

Question 55

Why do eligibility rules matter in digital identity workflows?

Accepted Answer

Eligibility rules prevent low-assurance automation from handling cases that need stronger verification. Without them, organisations either create avoidable friction for simple cases or under-protect high-risk cases. Clear rules also make it easier to explain decisions, audit outcomes, and reduce rework across the lifecycle.

Question 56

What breaks when biometric identity checks are used without fallback processes?

Accepted Answer

When biometric checks fail and there is no governed fallback, legitimate users can be stranded and staff may bypass controls to restore service. That creates both service disruption and security risk. A controlled fallback preserves assurance while giving reviewers a clear path for exceptions.