Every identity system in your enterprise carries a hidden design assumption: that a person is on the other end of the request. A person who authenticates in the morning, holds a session, clicks through a consent screen, and can be reached on Slack when something looks wrong.
Agentic AI removes the person. What's left is a credential holder that acts continuously, at machine speed, on inferred intent — and there are now vastly more of them than there are of you.
Non-human identities outnumber human users by roughly 45 to 1 in the modern enterprise, and as much as 100 to 1 in some organizations, according to Rubrik Zero Labs. Every agent, every workload, every ephemeral function is a credential holder. And every one of those credentials is a potential entry point.
This is a longer look at what actually changes when identity becomes the control plane for autonomous systems — and what a working zero-trust fabric looks like on live infrastructure.
The 45:1 ratio is the headline, but it isn't the problem. The problem is what those identities look like once you inspect them.
Rubrik's research found that 47% of non-human identities are more than a year old with no credential rotation, and that two-thirds of enterprises have already suffered a breach via a compromised NHI. Separately, IBM X-Force reports that identity-based attacks now account for 30% of intrusions — tied with public-facing application exploits as the leading access vector. Attackers aren't breaking in. They're logging in.
Agentic AI makes this materially worse in three specific ways.
Intent is inferred, not declared. A human clicking "export report" has expressed intent. An agent handed the prompt "summarize our customer database" has been handed an objective, and it will decompose that objective into whatever sequence of API calls it judges necessary. You authorized a summary. You may have gotten a full table scan across three systems.
Boundaries are dynamic. A traditional service account does one thing on a schedule. An agent's blast radius changes with every prompt, every tool it discovers, every chained call. Static scopes assume a fixed job description. Agents don't have one.
Behavior is non-deterministic. This is the structural break. Every control we've built for machine identities — scopes, roles, entitlements — assumes that if you constrain what a workload can do, you have constrained what it will do. That holds for deterministic software. It does not hold for a system whose next action is a probability distribution influenced by untrusted input.
That last point is why prompt injection isn't a model-safety curiosity; it's an access-control problem. If an attacker can influence what an agent decides to do, and the agent holds a broadly-scoped token, then the attacker holds a broadly-scoped token. The Model Context Protocol specification is candid about this: security enforcement is left to the implementor. Proxies should be used. How they enforce is undefined.
Zero Trust was never really about users. Its core claim — no implicit trust, verify every request — applies more cleanly to machines than it ever did to people. We just never enforced it that way, because machine access was invisible and low-volume enough to ignore.
Applied honestly to NHIs, four principles do the work:
Every identity is attributable to a human principal. An agent should not have its own standing entitlements. It should act on behalf of an identity from your IdP, and that attribution should survive every hop. When an agent modifies a production config, the audit log should name the engineer whose prompt started it — not svc-agent-prod-07.
Authorization happens per action, not per session. Authentication at connection time tells you who showed up. It tells you nothing about the 400th tool call in a long-running session. Each action needs to be evaluated against live policy: who is this for, what is being touched, is this appropriate right now?
Credentials are short-lived and never handled by the agent. Long-lived tokens are the single largest contributor to the 45:1 problem. An agent that never holds a durable credential can't leak one.
Enforcement and observability are the same system. If the component making the allow/deny decision isn't also producing the log, your audit trail is a reconstruction. For autonomous systems making thousands of decisions an hour, reconstruction is not an option — for incident response or for SOC 2, HIPAA, ISO 27001, or NIST 800-53.
The uncomfortable implication for leaders: none of this can be solved at the model layer, and none of it can be solved by an identity provider alone. Your IdP knows who your people are. It has no opinion about whether this request, right now, should be allowed. That decision has to happen in the data path.
You cannot make an agent predictable. You can make the boundary it operates against completely predictable. That asymmetry is the whole strategy.
Pomerium is an identity-aware proxy that sits between agents and the systems they reach, enforcing Zero Trust at the application layer. It doesn't try to constrain the model. It constrains the action — deterministically, on every request.
Per-request authorization. Pomerium evaluates each request against live policy using all available context: identity, role and group membership, device posture, time of day, request origin, path, action type, session attributes, even request body metadata. Same agent, same token — the moment a condition changes, the request is denied. An agent can query customer records only if it's acting on behalf of a support engineer, during business hours, from a trusted device. That's the difference between a permission and an authorization.
Tool-level policy for MCP. Because Pomerium understands MCP, policy can restrict which tools an agent may invoke at all:
routes:
- from: https://github.localhost.pomerium.io
to: http://localhost:3020
policy:
allow:
and:
- domain:
is: example.com
- mcp_tool:
in: ["search", "fetch"]No token passthrough. Pomerium validates external identity tokens, translates them into short-lived scoped JWTs, and injects them as signed identity assertions. Your MCP servers never see a raw OAuth token. Nothing sensitive sits client-side. Backend services trust Pomerium's signature — not an arbitrary bearer token of unknown provenance. Token leakage, credential sprawl, and lateral movement all shrink at once.
Prompt injection becomes containable. A successful injection still confuses the agent. It does not grant access, because the policy engine evaluates the action, not the input. The unauthorized call is blocked, logged, and contained. Agent behavior is decoupled from system access.
One policy layer, human and non-human. The same engine governs engineers reaching Grafana or ArgoCD, CI pipelines deploying to prod, and LLM agents triggering internal workflows. Policy is declared once and applied everywhere — no auth logic reimplemented in every MCP server, no per-app redeploy to change a rule.
It runs in your environment. Pomerium is open source (Apache 2.0), built on Envoy, and deploys into Kubernetes, cloud, or on-prem. It supports gRPC, HTTP/2, and WebSockets, so it works with real MCP stacks and long-lived streams. Traffic never leaves your infrastructure and never transits a vendor relay. Latency overhead is measured in single-digit milliseconds against LLM calls measured in seconds. For teams that want a managed control plane, Pomerium Zero provides one without giving up data residency.
Inventory your non-human identities and their age. If you can't produce a list of every token, service account, and agent credential with a last-rotated date, you don't know your attack surface. Start there.
Kill long-lived credentials on the agentic path first. Agents are the fastest-growing and least predictable consumers of standing access. Broker their credentials rather than issuing them.
Put an enforcement point in the data path. Not a scanner, not a CSPM dashboard — a component that can deny a request in flight and log why.
Require human attribution end to end. Make "which person did this agent act for?" answerable from a log line, not an investigation.
Pick a pilot with real stakes. One internal MCP server, one agent, one policy that meaningfully restricts it. Watch the deny logs for a week. They will tell you more about your agents than any architecture review.
Autonomy without governance is risk. The perimeter is no longer a network — it's intent, and you can't secure intent with static credentials.
Stay up to date with Pomerium news and announcements.
Embrace Seamless Resource Access, Robust Zero Trust Integration, and Streamlined Compliance with Our App.
Use Cases
Quicklinks
Stay Connected
Stay up to date with Pomerium news and announcements.
