Per-developer environments were the goal. Then agents moved the goalposts, turning a familiar security model into a moving target for enterprise IT environments.
As organizations move agentic AI from experiments into operations, the container model does not map cleanly to many enterprise IT environments. An AI agent can act on a user’s behalf, call an MCP server, or spin up subagents, creating a chain of delegated actions that changes the security problem at runtime.
Delegation Can Expand Authority
A user delegating work to an agent often gives that agent permissions to act on the user’s behalf. That permission may travel through the workflow when the agent calls another system or launches a subagent, carrying forward tokens or broadening the scope of access.
This creates a self-escalating privilege chain. Each delegated action can add another step, another identity, or another permission to the process, making it harder to determine where authority began and how far it has moved.
The risk does not depend on an agent breaking a rule at the start. A workflow can expand its authority through normal actions, with each handoff carrying access into the next part of the chain. Security teams need to operationalize against these self-escalating privilege chains and rethink zero trust principles for agentic AI.
That challenge reaches into familiar identity failures. Static long-lived secrets and overbroad OAuth scopes remain relevant failure modes in agentic workflows, where access can move between users, agents, tools, and services.
Identity Must Follow Every Action
The secret zero problem adds another layer of danger. Bootstrap credentials can unlock access to other secrets, creating a starting point with enough power to open the next stage of a workflow.
Passing user tokens to other agents or tools can also lead to impersonation and loss of action attribution. When an action takes place, security teams need to know whether the user authorized it directly or whether an agent performed it independently.
A secure system should make that difference clear. It should distinguish actions explicitly authorized by the user from actions performed independently by agents, preserving the identity behind each step instead of treating every action as part of one shared session.
Runtime enforcement provides the control point. Systems should issue dynamic, short-lived credentials tied to the task, the agent, the user, and the moment of execution, then constrain access while the workflow is running.
This approach changes the question from “What can this identity access?” to “What may this identity do for this task right now?” That shift matters because an agent’s authority can change during execution, especially when it calls an MCP server or spins up subagents.
Zero Trust Needs an Agentic Blueprint
Agentic workflows are already appearing through developer tools, automation platforms, and AI-enabled SaaS integrations. The technology is moving from isolated experiments into operating environments, placing identity and access decisions inside everyday business workflows.
Most zero trust programs were designed around human users and static roles. Those assumptions do not fit realities where an agent receives delegated authority, passes tokens, starts another agent, and acts across several tools during one task.
Existing zero trust principles still provide a blueprint for adapting to agentic AI workflows. The core idea remains direct: verify access, limit authority, and enforce controls where actions happen. The difference is that the system must apply those controls to agents and delegated workflows, not only to people and fixed roles.
Operationalizing agentic AI means treating identity, secrets, certificates, and privileged access as the control plane for actions. These elements determine who or what can act, which task permits the action, and whether the access should continue at that moment.
Access should be constrained and enforced in the moment, not only audited after the fact. An audit can explain a privilege chain after it expands, but runtime enforcement can limit that chain before it reaches the next system.
The goal is not to stop agentic workflows. It is to give them boundaries that match how they operate. As agents take on more delegated work through developer tools, automation platforms, and AI-enabled SaaS integrations, enterprise security will depend on tracking every handoff, limiting every credential, and preserving attribution from the first instruction to the final action.
Based on
