Why do identity and access reviews struggle with agentic workflows?

Why access reviews break down when workflows become agentic

Access reviews are built for relatively stable entitlements, so they work best when a reviewer can confirm who should keep which permission over time. Agentic workflows change the unit of control: the meaningful security decision is often made inside the session, when the agent assembles context, chooses a tool and acts. That makes static certification too slow and too coarse to capture the real risk surface.

In practice, the review process sees a role or account, while the control problem lives in the sequence of actions that the agent can take. An agent may use different tools, scopes or delegated permissions across a single workflow, so the access decision is no longer a single yes or no at provisioning time. The review has to understand runtime authority, not just recorded entitlements.

That is why traditional recertification can miss the most important question: what can the agent do right now, with this context, for this task, and under these conditions? If the workflow can expand or narrow authority dynamically, then an annual or quarterly review will often certify a state that no longer describes actual behaviour.

What changes about governance when the decision moves into the session?

Governance shifts from inventorying standing access to governing action. That means the control objective becomes per-action authorization, short-lived privilege, and observable execution rather than broad role ownership alone. AI Agent Authorisation Guide is a useful reference point because it frames least privilege for agents as task-scoped, just-in-time access with human approval where needed.

The practical difference is that access review now depends on richer evidence: which tools were invoked, which scope was granted, what context was present, and whether the agent was allowed to escalate or chain actions. AI Agent Observability, Audit and Incident Response Guide shows why logging, attribution and a tested kill switch matter when actions happen faster than a reviewer can inspect them later.

This also changes how organisations think about identity governance. IAM and IGA Basics remains relevant as the parent governance model, but the agentic case pushes it toward dynamic entitlements, delegated authority and continuous evaluation rather than periodic sign-off.

Which failure modes make agentic reviews unreliable?

One failure mode is certification drift: the reviewed permission set no longer matches the live workflow because the agent can adapt its next step without a new approval event. Another is reviewer fatigue, where broad agent permissions are rubber-stamped because the reviewer cannot realistically assess each possible tool chain or conditional path. A third is hidden privilege concentration, where a harmless-looking account can assemble a high-impact action chain once runtime context is available.

These failures get worse when agent credentials, tool permissions and business approvals are treated as separate concerns. The agent may look low risk in the directory, yet still be able to reach sensitive systems through chained calls, shared context or delegated tokens. That is why NIST AI Risk Management Framework is relevant here: the control problem is not just identity assignment, but managing trustworthy behaviour across the full AI lifecycle.

Runtime visibility also matters because malicious or unintended behaviour often appears as ordinary workflow execution until the point of impact. OWASP Agentic AI Top 10 is useful for mapping those failure modes, especially identity and privilege abuse, tool misuse and cascading failures.

Risk and Threat Considerations

Agentic workflows create a material control gap because the access decision and the harmful action can happen in the same session. That shortens the defender’s detection window and makes stale certification a weak signal for actual authority.

Failure mechanism: An agent receives enough delegated access to chain context gathering, planning and tool execution before any periodic review can observe the sequence as a whole. This lets privilege, scope and intent diverge inside the workflow.

Impact: Excessive or mis-scoped authority can persist unnoticed until the agent reaches sensitive data, executes an irreversible action or amplifies a mistake across multiple downstream systems.

Practitioner Guidance

What to prioritise: Review the permissions that enable action, not just the identity record that holds them. For agentic workflows, the highest-value control is usually the point where a tool call, scoped token or delegated permission becomes usable in production.

What to verify: Confirm that reviewers can see the actual task scope, the allowed tool set and the conditions that triggered access at runtime. If that evidence is missing, the review is mostly documenting trust rather than validating it.

Decision rule: If a permission can materially change system state, reach sensitive data or chain into another privileged step, govern it as runtime authority and not as a static entitlement alone.

Practitioner takeaway: Traditional access reviews still matter, but for agentic workflows they are only a baseline. The control objective has moved to continuous, action-level governance, with tight scope, strong observability and fast revocation when runtime behaviour diverges from the approved task.

Related resources from NHI Mgmt Group

• When does just-in-time access reduce risk for agentic AI, and when does it fall short?
• How should security teams govern machine identity credentials in agentic AI environments?
• Why do traditional access reviews struggle with agentic systems?
• Why do agentic AI security workflows need identity and access controls?