Agentic AI Is Outrunning the Access Model It Inherited

There’s a pattern emerging in enterprise architecture reviews right now. The conversation starts with the AI initiative being scoped, and ends with the same question: who or what will grant these agents access, and on what terms?

This is a hard question because the access models doing the granting were designed for a world with two identity types. People who logged in, asked for what they needed, and waited for approvals. And machines, which were narrow, deterministic, and ran on credentials provisioned once and rotated quarterly. Access decisions could be slow, because the actors moving through the system were slow.

Agentic AI isn’t slow or deterministic, and it doesn’t ask for permissions in the same way.

What’s Changed

An agent reasons, interprets intent, chains tool calls, queries databases, hits APIs, and initiates actions based on context that didn’t exist five seconds ago. It can schedule meetings through a calendar API, process refunds through Stripe, and pull customer records into a retrieval pipeline in the span of mere minutes. None of it was scripted in advance.

That speed and autonomy are the point. They’re also part of the architectural problem.

When the actor making the access request can spawn thousands of decisions per second across multiple systems, “should this identity be allowed to do this thing right now” has to be answered at machine speed, or it doesn’t get answered at all.

Walk through what most organizations have in place to control this, and the gaps surface quickly. Credentials issued for a task and left active long after the task ended, because the agent has no concept of “done.” Permissions are scoped for a single predictable use, and then reused across dozens of variations of that request. API tokens and service account passwords embedded in codebases, rotated rarely, and exposed to every commit. Tool integrations increasingly brokered through emerging standards like Model Context Protocol (MCP), that widen what an agent can reach faster than anyone widens what they see or govern. Agentic identities running with no audit trail, policy attachment, or clear ownership, because the access infrastructure doesn’t know what they are.

These aren’t new failure modes. What’s new is the velocity of the agents.

The Credential Path Has Become the Path

Cyberattacks using stolen or compromised credentials are the dominant intrusion vector. CI/CD pipelines and automation infrastructure are where this plays out most, because that’s where standing access concentrates and the line between “machine” and “agent” is most blurry.

Agentic AI doesn’t change the risk category. It changes the surface area. An agent that can spawn 10 parallel tool-call sessions in service of a single user prompt generates 10 new opportunities for that exact pattern every time it runs.

Zero Standing Privileges, Plainly

The answer is Zero Standing Privileges (ZSP), where no identity, whether human, agentic AI, or non-human machine, holds always-on access to anything by default. Access is minted when needed, scoped to specific tasks, and destroyed upon completion. Continuous authorization decides whether a request is valid. Enforcement acts on it at runtime.

With ZSP, there’s no entitlement sitting in a directory waiting to be misused, because nothing persists past the session. Audit stops being a quarterly reconciliation exercise. Every action is its own logged, time-bounded event, traceable from the person or process that initiated it, through the agent that acted, the tool it invoked, and the resources touched..

What This Looks Like in a Multi-Agent Workflow

Consider a travel-planning system built from four agents. One gathers user preferences. A second searches inventory and produces itinerary options. A third executes the booking. A fourth reconciles the transaction.

Under the inherited access model, each agent gets credentials provisioned to every system it needs to touch, which persist whether the agent is actively running or not. Under ZSP, agents receive narrowly scoped, ephemeral access at the moment of execution. The preference agent gets read-only access to the user profile, valid for the seconds it takes to extract intent. The search agent gets read access to inventory APIs, valid for the duration of the query. The booking agent receives write access to airline and hotel systems, valid only for the transaction window, and it acts on behalf of the traveler who initiated the request, bound by that person’s own entitlements rather than a broader service account the agent happens to share. The reconciliation agent gets read access to the transaction log, valid only while it audits.

The booking agent is also the one spending money, which makes it a natural place for a human approval gate. High-risk actions trigger review, but read-only steps earlier in the workflow never have to. When a reconciliation flags a discrepancy, the trail leads back through each of the four agents to the request that set them in motion.

How Teams Actually Get There

Teams can’t migrate to ZSP overnight unless they’re looking forward to breaking existing processes. It happens incrementally, with scope that earns its way up.

Crawl – Visibility. Organizations underestimate how many agentic workflows are running in their environment. Some were created by platform teams and others by users who connected a corporate identity to a tool and let it run. Start by inventorying which agents are operating, where they’re deployed, what credentials they’re using, and what systems those credentials reach. The shadow-AI sprawl is the first thing to surface, because everything downstream depends on knowing what’s there.

Walk – Identity Parity. Every agent has an identity. Not a borrowed service account. Not credentials embedded in someone else’s pipeline or shared API tokens sitting in a config file. Identity is the unit of accountability, and once an agent has a managed identity with attached policy and an audit trail, every other security control has something to bind to. Attribution is also what makes delegation safe: when an agent acts on someone’s behalf, the policy binding it should be that person’s, and the record should show both the human and the agent behind it. This  step closes the worst class of exposure, agentic activity nobody can attribute or revoke, because it’s running on credentials that don’t belong to it.

Run – ZSP. The end state. No persistent access for any identity. Access is minted at runtime, scoped to the task, and destroyed when completed. The audit and access trail are the same because there’s no separation between them. This architecture matches the velocity of the workloads it’s controlling, and can scale without compounding the problem.

So What?

The speed-versus-security tradeoff is a false one. It’s an artifact of access models that were never designed to operate at the velocity of the workloads they must control. Once the architecture is right, the two stop being opposed.

The hybrid organization is already being built. Humans, agentic AI, and the non-human machine identities that already outnumber both. The infrastructure granting access either keeps up, or it doesn’t. There isn’t a third option.