"Palo Alto Networks puts the ratio of non-human identities to human identities at 109 to 1, including 79 AI agents."
Agents are "guessing at scale" — and that improvisation breaks old models
Watch Claude work through a long task, the source advises, and you'll see how modern agents operate: they try actions, observe results, adapt and continue. That probabilistic loop — trying a next-best action, learning, then trying again — is the feature that makes agentic AI useful. It is also the feature that undermines security models built for predictable workflows. When an agent improvises, every unanticipated step can become a security risk if the agent holds broad permissions.
The difficult access decisions every team faces
Token Security frames a common set of unresolved choices that teams deploying agents encounter: whether to grant every possible tool or only those likely needed; whether to give admin authority for rare edge cases; and whether to provision broad, persistent access or scope permissions to the immediate request. The article notes these are not academic problems — applying least privilege to agents and to every session they run is "orders of magnitude harder" than for human users, and teams often choose the path of least resistance by granting broad permissions that agents then inherit by default.
Why prompt filtering and prediction are the wrong layer
For roughly two years, many AI security efforts concentrated on shaping model output with guardrails: prompt filtering, input/output constraints, and behavior controls. Token Security argues that these guardrails are useful in places but miss the core vulnerability. Filters operate after an agent already holds credentials; once access is granted, a filter can shape what the agent says but cannot undo what the agent is allowed to do. Prediction-based defenses also fail structurally: two agents with identical permissions can behave completely differently depending on context, so profiling past behavior does not secure a goal-driven system whose next action depends on novel contexts.
Identity is the only control plane that spans every action
Strip away model and prompt, Token Security writes, and a constant remains: every agent action flows through an identity. Agents authenticate with service accounts, API keys, OAuth grants, cloud roles, or tokens. That universality makes identity the layer where controls can be applied consistently. Identity determines the "blast radius" of a wrong guess; autonomy determines how quickly a wrong guess can execute before human intervention. Static IAM policies, designed for human logins reviewed quarterly, were not written for agents that "never sleep, don’t use MFA, and are rarely retired."
Intent-based security: the missing dimension of least privilege
Traditional access control asks what an identity can do. Token Security contends that for agents that act toward goals, that question is incomplete — purpose matters. An agent resolving a failed deployment and an agent exfiltrating data can perform nearly identical low-level actions. Intent-based security asks instead what an agent should be able to access to accomplish its purpose and nothing more. By modeling intent, permissions can be tightly scoped and anything outside the defined intent becomes a signal to act on. Token Security positions this as the operational answer to least privilege: model intent for each agent and enforce access controls automatically against that model.
What this means for security teams, procurement leaders, and end users
- Security teams and technologists: The practical work is preventative and continuous: discover every agent and the identities it uses across cloud, SaaS, endpoints, and AI platforms (including shadow agents), understand what each agent can access and what it is meant to do, and automatically enforce scope and lifecycle actions such as revocation when an agent is retired.
- Procurement leaders and enterprise IT: The article implies a changed procurement signal: buyers should expect identity-layer controls and intent-based enforcement rather than relying primarily on model guardrails or periodic IAM reviews, because risk "accumulates as access piles up and ownership blurs."
- End users and teams deploying agents: Because most teams cannot inventory agents and their permissions, defaulting to broad access is common. The consequence is that agents inherit large blast radii; organizations must anticipate that agents will be spun up quickly and often outside formal security review.
Visibility alone is not enough. Token Security's prescription is explicit: discover, model intent, right-size permissions, enforce automatically, revoke on decommission, and govern the full lifecycle. In short, if agents will keep improvising, the only controllable variable left is the size of the sandbox they improvise inside — and the layer that actually draws that sandbox is identity scoped to intent, enforced before the action rather than explained after.
