October 14, 2026
Posted by Refael Angel
Summary:
AI agent security requires controls that govern what agents actually do, even when they have legitimate access. A new Gartner report makes the case for independent runtime authorization that evaluates agent actions as they happen. Here’s why traditional identity and secrets management fall short, and how Akeyless Agentic Runtime Authority addresses the gaps.
On 6 October 2026, Gartner published Agentic Security: The Future of Agent Identity Belongs to Runtime Authorization (Ayelet Heyman, Ted Ernst, Grace Keyes). Readers with a Gartner subscription can access it here. The note is short, and its conclusion is direct: the tools enterprises are using to manage AI agent identities were not built for the job. They can establish identity and grant access, but have little control over what an agent does next. Gartner calls for an independent runtime control plane that connects human intent to authorization decisions at the moment an agent acts
The analysis closely reflects the challenges we’ve been working to address at Akeyless, and the thinking behind the design of Agentic Runtime Authority.
What Gartner Found
The 2026 Gartner Surviving the Agentic AI Era Survey, fielded among 251 CISOs and their direct reports, shows how fragmented AI identity management has become. Organizations reported relying on existing workload access management tools (45%), the agent platforms themselves (41%), and secrets management tools (36%) to inventory and manage generative AI identities. The result is a patchwork of tools that leaves CISOs without a unified way to enforce policies across agents.
The report’s analysis of why this matters comes down to three findings:
Non-human identity tooling assumes predictability. Traditional workload identity and secrets management tools were designed around predictable machine-to-machine interactions. AI agents can change their course of action based on the information they encounter.
Gartner’s point is that a secrets manager can confirm an agent is authorized and hand it a credential, but it has no view of the prompt logic driving the request or of the tool parameters the agent is about to send. The agent receives broad, ambient authority, and from that moment the decision about every action belongs to the agent.
Agent orchestrators are absorbing access control. Because the orchestrator sees the prompt and controls tool calling, embedding permissions there is fast and natural for developers. But when HR, engineering, and sales each use a different agent platform, the CISO faces fragmented policies and no consistent way to enforce them. Gartner draws the historical parallel with cloud IAM: enterprises eventually refused to let platforms “mark their own homework,” and the same separation will be forced on agent platforms.
The winning architecture is independent and dynamic. Gartner’s recommendations to vendors are specific: map the human who delegated a task to the agent that performs it, across every orchestrator; replace static credential vaulting with short-lived, task-bounded execution tokens tied to real-time inspection of tool parameters; and stay independent of any single agent platform.
The report also sketches the failure mode in one scenario. An agent authenticates to a secrets manager and receives an API key with broad read and write access. It then processes an untrusted document carrying an indirect prompt injection. Although its reasoning changes, the credential it holds does not care. Because the vault only ever checked who the agent was, the agent now uses its full permissions to do something nobody authorized.
Why AI Agents Need Controls Beyond Secrets Management
Akeyless earned its reputation in secrets management, so we want to be clear about this: the report’s critique is accurate. Storing a credential securely and handing it to an agent is delegation, not governance. That model works for a deterministic service with a fixed job. But an autonomous agent can be redirected by a single string in a document, a Slack message, or a web page, carrying the original credentials and access with it.
We built Akeyless Agentic Runtime Authority to address this gap. It extends the Akeyless Identity Security Platform and its Modern PAM capabilities into AI workflows with an access model designed specifically for autonomous agents. The agent never holds a credential, and every requested action must pass an intent-aware policy check before access is granted. The Akeyless Gateway brokers every agent request, regardless of the framework or target system. It verifies identity, evaluates intent, enforces policy, controls data exposure, and records activity for audit, all in a single path.
Gartner’s Runtime Authorization Recommendations In Practice
Gartner’s recommendations are specific about what effective runtime authorization requires, from task-bounded access and intent-aware policy enforcement to consistent controls across agent platforms. Here’s how those recommendations translate into the architecture and capabilities of Akeyless Agentic Runtime Authority.
| Gartner’s findings and recommendations | How Akeyless Agentic Runtime Authority delivers it |
|---|---|
| Short-lived, task-bounded execution tokens instead of static credential vaulting | Agents carry zero credentials. When an action is approved, the Gateway mints a Dynamic Secret with the minimum permissions for that task, injects it into a brokered session the agent never sees, and destroys it on the target when the task completes or the TTL expires. |
| Runtime authorization tied to real-time inspection of tool parameters | Every request is intercepted at the Gateway and classified for intent (read-only, data modification, destructive, privilege escalation) with a risk score, then checked against intent-aware rules the owners of the target system defined in advance. This happens before any credential exists, and commands continue to be validated for the life of the session. |
| Govern what the agent executes, not just who it is | Each request carries the raw prompt that motivated it. Authorization is a decision about the action, made on every command, not a role check performed once at login. |
| An independent, platform-agnostic control plane | The Gateway accepts requests over MCP, Agent Skills, native tool calling for OpenAI, Anthropic, Gemini, and Bedrock, framework plugins for LangChain, LlamaIndex, Semantic Kernel, CrewAI, and AutoGen, agent-to-agent handoffs, and direct SDK or REST. It brokers them to databases, cloud provider APIs, Kubernetes, SaaS, SSH, RDP, and legacy systems. Enforcement remains independent of the agent’s orchestration platform. |
| Map human delegators to agent delegates | On-Behalf-Of authentication carries a validated human identifier alongside the agent identity through OIDC and SAML claims. The same Auth Methods cover copilots acting for a person, autonomous agents running on workload identity (cloud IAM, Kubernetes service accounts, SPIFFE), and goal-based agents that live for seconds. |
| A single, auditable policy layer owned by the business process | Policies are bound to Auth Methods and target systems and authored by the people who own those systems. They are enforced identically whichever team’s framework issued the call and take effect at the agent’s first authentication.This keeps access policies consistent across agent platforms. |
| Real-time execution lineage rather than static secret discovery | One immutable record per action: actor context, raw prompt, classified intent, policy verdict, session, and the exact command executed on the target. Live sessions can be revoked with a one-click kill switch. |
| Protection against prompt injection and data exposure | Sensitive fields (PII, PHI, financial records, secrets) are masked inside the brokered session, before they reach the agent’s context window. |
Gartner’s Prompt Injection Scenario, Replayed with Akeyless
Consider the reporting agent in Gartner’s example. Its owner has established a rule allowing read-only queries against the reporting database, nothing else. The agent ingests a poisoned document and its reasoning shifts toward a destructive command.
With Akeyless Agentic Runtime Authority, the agent never receives an API key to misuse. It has no direct network route to the database, because all traffic is brokered through the Gateway. When the request arrives, the Gateway classifies the attempted action as destructive, compares it with the rule, and denies it before a credential is minted or the database touched. The audit record captures the prompt, the classification, and the verdict, attributed to the agent and to the human who delegated the task.
The protection holds even if the prompt injection goes undetected. The agent cannot change the access rules or bypass the Gateway that enforces them..
Runtime Authorization Depends on Workload IAM
Runtime authorization relies on knowing which agent is acting, what permissions it holds, and whose authority it is exercising. Without that identity context, even sophisticated runtime controls cannot reliably determine whether an agent’s actions fall within its authorized scope.
Gartner addressed this foundation just six days before publishing its runtime authorization research. In Agentic Security: Secure AI Agents With Workload IAM Architecture, Gartner urges enterprises to treat AI agents as workloads, applying established IAM practices for managing identities, credentials, permissions, and delegated access.
The need is pressing. Gartner found that 42% of organizations surveyed lack a formal machine IAM strategy. Its recommended architecture combines centralized identity governance and authorization policy management with workload access controls across different environments. These capabilities establish the trusted identities and access boundaries that runtime authorization depends on.
Gartner’s April 2026 Reference Architecture Brief: IAM for AI Agents and Other Workloads provides additional architectural guidance and includes Akeyless among its example technologies.
Taken together, the reports point to an important principle: identity and access controls establish an agent’s authority, while independent runtime enforcement keeps its actions within that authority. Akeyless solves both.
One Policy Layer Across AI Agent Platforms
Gartner warns that prompt filtering will become commoditized and static identity tools risk becoming passive identity providers. Directories establish identity; prompt filters screen content. Neither governs what an agent executes. Akeyless uses RBAC and ABAC to set the floor (which systems an agent can reach), while intent-aware policies set the ceiling (what it can do there).
Architecturally, Akeyless combines a SaaS control plane for policy and intent with a customer-side Gateway for execution, credential provisioning, session isolation, and audit. Secrets never leave the Gateway boundary, protected by patented Akeyless DFC™ (Distributed Fragments Cryptography) and a Zero-Knowledge model, on a FIPS 140-3 validated platform.
This also addresses Gartner’s fragmentation concern. Agentic Runtime Authority uses the same Gateway, Auth Methods, and audit pipeline that already govern human and machine privileged access, alongside Akeyless Secrets Management, Certificate Lifecycle Management, and Multi-Vault Governance. AI agents come under the same policy layer without adding another security silo.
The Takeaway
The real test of AI agent security comes after authentication. Workload IAM establishes which agent is acting and what authority it holds. Independent runtime authorization determines whether that authority extends to the specific action the agent is about to execute, even when its behavior has been redirected.
For enterprises deploying autonomous agents into production, the challenge is to give them enough access to do meaningful work while maintaining control. That requires enforceable limits on their actions and a clear record of who authorized them.
Request a demo to see how Akeyless Agentic Runtime Authority puts these controls into practice.
Gartner is a registered trademark of Gartner, Inc., and/or its affiliates. Gartner does not endorse any company, vendor, product or service depicted in its publications.
