Where do NHI controls fall short when AI agents are added to the mix?

Where NHI Controls Stop Being Enough for AI Agents

NHI controls are built for identities that mainly need ownership, secret hygiene and lifecycle discipline. AI agents change the problem because they can make runtime choices, invoke tools and vary their behaviour within an allowed scope. That means the control surface expands from “who owns the credential” to “what actions this identity may take, when, and under which policy checks.”

The gap is not that NHI fundamentals stop mattering. It is that they describe only the durable identity layer, while agents also need governance over delegated authority, per-action authorization and tool access. If you treat an agent like a well-managed service account, you can miss the higher-risk part of the system, the point where software decides and acts on its own.

The practical distinction is that a non-human identity can be static even when the workload is dynamic, but an agent can change its operational path as context changes. That makes runtime policy, request evaluation and constrained delegation first-class controls, not optional extras.

What NHI Controls Cover Well, and What They Do Not

Traditional NHI controls are strongest when the risk is credential-centric: offboarding stale identities, rotating secrets, enforcing ownership, limiting standing privilege and maintaining inventory. Those controls reduce exposure from leaked tokens, orphaned accounts and overbroad access, which are still common failure modes. NHI governance and lifecycle guidance remains useful for that layer, because it keeps identities discoverable, bounded and revocable.

They are weaker when the material risk is behavioural. An agent may hold a valid credential and still do the wrong thing by selecting an unsafe tool, chaining actions in an unexpected order or acting on a prompt that changes its immediate objective. In that case, the issue is not secret leakage alone, it is delegated action without sufficient runtime control.

That is why the control question changes from “is the credential protected?” to “is the action authorised at the moment of use?” For agents, the answer has to include task scope, request context, approval thresholds and the ability to halt or narrow a session when the action exceeds intent.

Why Agentic Systems Need Action Boundaries, Not Just Identity Boundaries

AI agents introduce a second layer of trust: the system must trust not only the identity, but also the agent’s decisions inside that identity. If the agent can call tools, browse data, trigger workflows or compose requests, then the security boundary sits around each action, not only around the account that performs it. AI agent authorisation guidance is relevant here because it shifts enforcement to per-action decisions and least-privilege delegation.

This is where many NHI programmes under-scope the problem. They may track the secret, but not the tool catalogue, request intent, environmental conditions or escalation path associated with the agent’s runtime decisions. The result is an identity that is technically controlled but operationally overpowered.

Zero standing privilege concepts become more important in agentic environments, but they are not sufficient on their own. The control objective is to ensure that the agent can only obtain the minimum access needed for a narrowly defined task, and only while the task is active and observable. Zero trust for AI agents is a useful complement because it emphasises continuous verification of the principal and the request, not just the presence of a valid credential.

What Practitioners Should Change in the Control Model

Practitioners should separate identity governance from action governance. Identity governance answers who the agent is, who owns it, how it is provisioned and how it is revoked. Action governance answers what the agent may do, which tools it may call, whether a human must approve certain steps and how to record that the action stayed inside policy.

What to prioritise: start with the actions that can create irreversible impact, such as spending, data export, privilege escalation, external communications or control-plane changes. If those paths are not bounded, the rest of the NHI programme can give a false sense of safety.

What to verify: confirm that each agent has a clear owner, a bounded task scope, explicit tool permissions and a revocation path that works during execution, not only at the end of a lifecycle review. The useful evidence is not just the credential record, but the policy that governs each high-impact action and the logs that prove it was enforced.

What practitioners underestimate: agent autonomy turns access from a static entitlements problem into a decision problem. The most common failure is assuming that strong secret hygiene automatically means safe behaviour, when the real exposure is an authorised identity taking an unauthorised path.

Practitioner takeaway: treat NHI controls as the foundation, not the finish line. For AI agents, the decisive control is whether each meaningful action is separately constrained, attributable and interruptible.

Related resources from NHI Mgmt Group

• When does just-in-time access reduce risk for agentic AI, and when does it fall short?
• Why do traditional VPN and OAuth controls fall short for AI agents?
• Why do KYC and KYE controls fall short for AI agents?
• Why do traditional RBAC and ABAC controls fall short for AI agents?