You get authentication without behavioural control. The directory can confirm that an agent is valid, but it cannot decide each downstream model call or tool call once the session is underway. That creates a gap between access establishment and action governance, which is exactly where high-risk agent behaviour needs control.
Why This Matters for Security Teams
Directory-layer identity answers a narrow question: is this agent known and permitted to exist? It does not answer the operational question that matters most in agentic systems: what is the agent allowed to do right now, in this context, with this tool, for this objective? That gap is why static identity binding is not enough for autonomous workloads. Current guidance from the OWASP Agentic AI Top 10 and NIST AI Risk Management Framework both push teams toward runtime controls, not just enrollment-time trust.
When an agent can chain prompts, call multiple tools, and escalate its own activity across a session, directory identity becomes only the first gate. The real risk is the uncontrolled path after login: model calls, token reuse, tool invocation, and lateral movement through connected services. NHIMG’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, which is exactly the kind of entitlement mismatch that directory-only identity cannot correct once execution begins. In practice, many security teams encounter this only after an agent has already called a sensitive tool or exfiltrated data through a trusted integration.
How It Works in Practice
Effective agent governance treats directory identity as a starting point, then layers runtime authorisation around each meaningful action. The agent should present a workload identity, such as an OIDC-based token or SPIFFE/SPIRE-backed identity, to prove what it is. From there, policy engines evaluate the requested action at request time, using context such as tool, dataset, user intent, environment, and session state. That is a different control model from RBAC alone, because the question is not “what role does this identity have?” but “should this specific action happen now?”
In practice, teams combine several controls:
- JIT credentials that are issued per task and revoked automatically on completion.
- Short-lived secrets instead of static API keys or long-lived service account tokens.
- Policy-as-code for real-time decisions using frameworks such as OPA or Cedar.
- Tool-scoped permissions so an agent can only access the exact capability required for that step.
- Session telemetry that detects abnormal chaining, repeated retries, or privilege expansion.
This matters because identity at the directory layer cannot distinguish between a safe read-only query and a high-risk write action once the session is active. NHIMG’s 52 NHI Breaches Analysis and the CSA MAESTRO agentic AI threat modeling framework both reinforce the same operational point: autonomous systems need decisioning at execution time, not just trusted registration. These controls tend to break down when the agent must operate across many delegated tools and tenants, because context becomes fragmented and policy enforcement can lag behind the action.
Common Variations and Edge Cases
Tighter runtime control often increases operational overhead, requiring organisations to balance safety against latency, developer friction, and service complexity. That tradeoff is real, especially in multi-agent pipelines where one agent hands work to another and the original directory identity no longer reflects the true risk of the next step. Best practice is evolving, and there is no universal standard for how much identity context should be inherited versus re-evaluated at each hop.
One common edge case is delegated execution through third-party platforms. A directory can authenticate the first agent, but it may not see downstream tool calls made through chained services, embedded copilots, or brokered workflows. Another is emergency automation, where teams are tempted to issue broader standing access “just in case.” That usually defeats the purpose of runtime control unless the exception is time-boxed, logged, and narrowly scoped.
Teams should also avoid assuming that a managed directory equals governance. Directory records can support inventory and offboarding, but they do not replace behavioural control, especially when an agent can dynamically select tools or adapt its plan mid-session. NHIMG’s Ultimate Guide to NHIs and Analysis of Claude Code Security show why static identity controls are necessary but insufficient when autonomous software can change what it is doing faster than directory governance can react.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Directory-only identity fails when agents need runtime action control. |
| CSA MAESTRO | TRUST-2 | MAESTRO addresses trust and control gaps in autonomous agent workflows. |
| NIST AI RMF | AI RMF supports governance for dynamic AI behaviour beyond authentication. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Long-lived NHI credentials weaken control when identities are only directory-bound. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust requires continuous verification, not trust after directory enrollment. |
Enforce continuous authorization for each agent action instead of trusting the session.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
