The Access Control Gap in AI-Native Architectures

As AI agents move from experimental deployments to core operational infrastructure, a structural gap has emerged in how organisations approach access management — one that conventional identity and access frameworks were never designed to address.

The shift enterprises are underestimating

Identity and access management, as practised across most enterprises today, was architected for a world of human users interacting with systems through predictable, discrete entry points. That architecture assumed a bounded number of identities, human-speed interaction patterns, and access decisions made at the point of authentication rather than continuously, per action.

AI-native organisations operate under fundamentally different conditions. Agents do not merely supplement the human workforce — in many operational models they constitute the majority of active identities within a system. They initiate calls to other agents. They compose multi-step workflows without human intervention at each step. A single user-initiated request can traverse a chain of ten or more agent-to-agent invocations before resolution.

This is not an incremental extension of existing access models. It is a different problem.

Delegation chains: the structural vulnerability

The critical distinction is this. Traditional access control answers the question of whether an identity is authorised to perform an action. Multi-agent systems require answering a more complex question — whether an identity is authorised to perform an action on behalf of a chain of prior delegations, each of which may have granted privilege in a context the current action was never intended to serve.

USER REQUEST
    │
    ▼
ORCHESTRATOR        holds broad standing access
    │
    ▼
RESEARCH AGENT      inherits the invoking credential
    │
    ▼
WRITER AGENT        three hops from the request

Effective access at hop three is whatever was
convenient at hop one. No individual link in the
chain was designed to grant it.

This is the mechanism behind confused-deputy vulnerabilities in agentic systems: privilege inherited across a delegation chain, expanding implicitly at each hop, until an agent several calls removed from the original request holds effective access that no individual link in that chain was designed to grant.

Static, role-based permission models do not account for this dynamic. They were not built to. The result is a class of exposure that scales precisely as organisations scale their agent deployments — the more sophisticated the automation, the larger the latent attack surface, unless the access model is designed to constrain it by default.

Requirements for a delegation-aware access model

Organisations building or scaling multi-agent systems require an access architecture with four characteristics that conventional IAM does not provide.

Granular sub-agent identity. Each agent within a delegation chain requires a distinct, scoped identity and permission set, rather than inheriting a shared credential from the identity that invoked it.

Attenuation by design. Privilege should narrow monotonically as it propagates through a delegation chain. An agent receiving a delegated task should hold access scoped precisely to that task — never the full privilege set of the agent that delegated to it.

Sub-millisecond evaluation at scale. In systems where delegation chains execute multiple agent-to-agent calls per user-facing request, access verification must introduce negligible latency. Authorisation architecture that measurably slows execution becomes untenable at production volume.

Full-chain auditability. Incident response requires more than identifying which agent performed an action. It requires reconstructing the complete delegation path — the sequence of invocations, the scope granted at each stage, and the point at which access was exercised.

The cost of deferral

Organisations early in their AI-native buildout often treat this as a future problem, to be addressed once agent fleets and delegation complexity have grown large enough to justify the investment.

This calculus inverts the actual risk profile. Access architecture is materially less costly to establish correctly during early-stage buildout than to retrofit once agent populations, integration surfaces and delegation patterns have scaled. Each additional agent deployed on a flat-trust foundation increases the eventual cost and disruption of remediation.

Organisations that establish delegation-aware access control while chain complexity remains manageable avoid the far more expensive proposition of migrating a mature, production-scale agent architecture under pressure.

A different starting premise

The core shift required is not additive. It is not another layer of tooling placed atop existing infrastructure. It is a different premise entirely: access is not a static grant assigned once to an identity and carried forward through every subsequent action. It is a continuous evaluation, scoped narrowly at every point of delegation, constrained to be no broader than the privilege that preceded it.

For organisations where AI agents remain a peripheral capability, this distinction may be immaterial. For organisations where agents constitute the operational core, it is the foundation on which system integrity depends.

The question worth resolving now, while delegation chains remain short and system complexity remains manageable, is straightforward: does your access architecture assume an agent inherits the privilege of whoever invoked it — and if so, is that assumption one your organisation can afford to carry forward at scale?