Should organisations rework access reviews for agentic AI?

Why This Matters for Security Teams

Access reviews were built for stable human roles, not autonomous software that can decide which tools to call, which data to touch, and which path to take next. For agentic ai, the real risk is not just whether an identity exists, but whether its current capability still matches the intended task, owner, and trust boundary. That is why static entitlement recertification often misses the actual exposure.

The issue is now visible across the market. NHIMG’s AI Agents: The New Attack Surface report found that 80% of organisations report AI agents have already acted beyond intended scope, while only 52% can track and audit what those agents access. That gap is exactly where access reviews break down. Current guidance from OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward runtime governance, not annual paperwork.

In practice, many security teams discover the review problem only after an agent has already chained tools, accessed sensitive data, or reused credentials in ways no entitlement spreadsheet would have highlighted.

How It Works in Practice

Reworking access reviews for agentic AI means reviewing the agent as an operating workload, not just as an assigned identity. Security teams should document three things for every agent: who owns it, what task it is authorised to perform, and what runtime conditions must be true before access is allowed. That shifts review from “does this account still exist?” to “is this agent still safe to let execute this action in this context?”

In mature programmes, the review artefacts include the agent’s workload identity, the tools it can invoke, the scopes attached to each token, and the policy engine that makes the decision at request time. This is where intent-based and context-aware authorisation matters. Instead of approving broad, long-lived access, teams should prefer short-lived, task-scoped access with automatic revocation when the job ends. That aligns with the direction of the CSA MAESTRO agentic AI threat modeling framework and the OWASP Non-Human Identity Top 10.

• Review the agent’s effective permissions, not just issued credentials.
• Confirm whether access is ephemeral, task-bound, and automatically revoked.
• Verify the owner, business justification, and rollback path for every privileged capability.
• Check whether policy is evaluated at runtime using the current request context.

Practitioners should also pull evidence from logs that show actual tool use, data touchpoints, and exception paths. NHIMG’s 52 NHI Breaches Analysis is useful here because repeated breach patterns show how quickly non-human identities become over-privileged when ownership and lifecycle controls drift. These controls tend to break down when an agent has broad API reach across SaaS, cloud, and internal systems because the access review no longer reflects the chain of actions the agent can assemble from those permissions.

Common Variations and Edge Cases

Tighter review requirements often increase operational overhead, so organisations have to balance stronger assurance against the cost of more frequent evidence collection and policy maintenance. That tradeoff becomes sharper as agents proliferate, because each new tool integration adds another place where access can become stale, excessive, or mis-scoped.

Best practice is evolving for shared agents, multi-agent workflows, and agents that inherit permissions from orchestration layers. There is no universal standard for this yet, but current guidance suggests reviewing both the primary agent and any delegated sub-actors or tool connectors. A proxy account can look benign while the real risk sits in the downstream token exchange or service-to-service trust chain. The same is true when agents are embedded inside developer tools, ticketing systems, or data pipelines, where access often appears “normal” until the agent starts making decisions at machine speed.

For that reason, access review for agentic AI should include whether the organisation can explain, in plain terms, why the agent still needs each capability. If the answer depends on a human remembering a past task, the review model is already too slow. In environments with high churn, parallel agents, or delegated tool use, static recertification alone will not keep pace with real behaviour. Use NIST AI Risk Management Framework and NHIMG’s NHI Lifecycle Management Guide to anchor ownership, review cadence, and revocation discipline.

Related resources from NHI Mgmt Group

• When does just-in-time access reduce risk for agentic AI, and when does it fall short?
• Why do agentic AI systems increase initial access and privilege abuse risk?
• What do teams get wrong about AI agent access reviews?
• How do organisations reduce AI exposure without blocking useful access?