Exploring non-human identity across workloads, AI agents, and beyond.
- Access Zero
- AI Agent Access
Secure Claude Access
Common Enterprise Agentic Workflows, Mapped for Security
Visualize and compare how AI agents operate across five familiar use cases, what they can access and do, where risks emerge, and which controls matter.
Enterprise Knowledge Retrieval
AI agents searche and synthesize information from approved enterprise and third-party sources without changing external state.
Representative Access Path
Typical Use
- Answer an internal policy question
- Summarize project or research documents
- Compare information across approved sources
Access Profile
Moderate
Autonomy
1/4
Sensitivity
3/4
System Boundaries
2/4
Consequence
2/4
Why this Profile
This is the control case for the series. Traditional delegated access still works reasonably well when the agent is primarily retrieving information, source permissions remain authoritative, and AI agents cannot silently expand their authority. The important security problem is authorization amplification through discovery and aggregation, rather than execution.
What Can Go Wrong?
- AI dramatically reduces the effort required to find and combine information.
- Several individually permitted sources can reveal something much more sensitive when aggregated.
- Overshared repositories can become easier to discover, and indexed or cached information may remain available after source permissions change.
- Retrieved documents can contain prompt injection or misleading instructions designed to influence later reasoning or tool use.
What Controls Should Apply?
- Preserve source-system authorization at retrieval time.
- Restrict retrieval by tenant, repository, site, dataset, or classification.
- Keep the workflow read-only unless another use case explicitly requires write access.
- Treat retrieved content as untrusted input.
- Enforce sensitivity labels, DLP rules, and contractual usage restrictions.
- Prevent cached or indexed content from outliving revoked source permissions.
- Preserve source attribution.
- Log the initiating user, agent, source, resource, and purpose of access.
Email & Calendar Assistance
AI agents read communication context and may draft, send, schedule, modify, or cancel items on a user's behalf.
Representative Access Path
Typical Use
- Summarize an email thread
- Draft or send a reply
- Schedule or modify a meeting
Access Profile
High
Autonomy
2/4
Sensitivity
3/4
System Boundaries
2/4
Consequence
3/4
Why this Profile
The security hinge is the transition from understanding information to changing something outside the model. The same context that helps AI agents draft an intelligent response can also become the input that persuades them to take an unintended action.
What Can Go Wrong?
- Email is both data and an instruction channel.
- A malicious message can attempt to persuade AI agents to disclose information, forward content, contact an external recipient, modify a meeting, or invoke another connected tool.
- Overbroad write permissions convert a mistaken model decision into an action performed with the user's apparent authority.
What Controls Should Apply?
- Separate read, draft, send, modify, and delete capabilities.
- Require confirmation or policy approval for consequential actions.
- Validate recipients, attendees, and targets immediately before execution.
- Apply additional restrictions to external communication where appropriate.
- Prevent instructions inside email from granting additional authority.
- Use short-lived, revocable delegated credentials.
- Log both the initiating human and the resulting agent action.
Software Development & CI/CD
AI agents can move from reading code into editing files, executing commands, invoking build systems, publishing packages, and reaching cloud infrastructure.
Representative Access Path
Typical Use
- Explain or modify a codebase
- Propose and test a patch
- Troubleshoot a build or deployment problem
Access Profile
Critical
Autonomy
2/4
Sensitivity
3/4
System Boundaries
3/4
Consequence
4/4
Why this Profile
This is where AI access becomes execution authority. The model itself does not define the blast radius. The terminal, credentials, repositories, build systems, and infrastructure placed behind the model do.
What Can Go Wrong?
- Once AI agents can execute commands, untrusted information can become execution.
- The agent may modify or delete files, install malicious dependencies, expose source code, misuse developer credentials, push unwanted commits, publish packages, or reach production infrastructure.
- Code, issues, documentation, package metadata, dependency output, and tool responses can all contain hostile instructions.
What Controls Should Apply?
- Separate read, write, build, publish, deploy, and cloud privileges.
- Use ephemeral credentials rather than inherited developer secrets.
- Scope authorization by repository, branch, environment, resource, and task.
- Sandbox execution where feasible.
- Constrain dangerous tools and network reach.
- Require review for merges, releases, package publication, and production changes.
- Keep development and production identities separate.
- Scan for secret and dependency risk.
- Record commands, tool calls, credentials used, and resulting changes.
Incident Response
AI agents begin from a security event, investigate across systems, choose their own next steps, and may take containment or remediation action without human approval at every stage.
Representative Access Path
Typical Use
- Investigate suspicious activity
- Correlate evidence across security systems
- Contain or remediate a confirmed incident
Access Profile
Critical
Autonomy
4/4
Sensitivity
3/4
System Boundaries
4/4
Consequence
4/4
Why this Profile
Autonomy changes the access model. AI agents are no longer simply performing one explicitly requested action using a person's delegated authority. It is deciding what to do next and crossing systems to do it. That makes the agent itself a meaningful security principal.
What Can Go Wrong?
- A broadly privileged SOC identity gives the agent administrator-level reach.
- Investigation privileges silently include remediation authority.
- A mistaken inference disables a legitimate account or production workload.
- Malicious or corrupted telemetry redirects the investigation.
- The agent moves across systems without new policy decisions.
- Elevated credentials remain usable after the incident ends.
- Individual systems record different actors, making the authority chain impossible to reconstruct.
What Controls Should Apply?
- Give the autonomous agent its own identity.
- Scope authority to the incident, affected resources, and time window.
- Separate investigation from remediation.
- Acquire short-lived credentials only when needed.
- Evaluate policy before consequential tool calls.
- Require approval for selected actions based on risk and blast radius.
- Restrict which accounts, workloads, environments, and resources may be changed.
- Automatically expire elevated authority.
- Preserve the complete sequence from triggering event through final action.
Procurement Operations
AI agents carriy a business process across systems, human approvals, and time, eventually reaching authority to commit company money.
Representative Access Path
Typical Use
- Research and compare approved vendors
- Prepare and route a purchase request
- Complete an approved purchase workflow
Access Profile
Critical
Autonomy
4/4
Sensitivity
3/4
System Boundaries
3/4
Consequence
4/4
Why this Profile
This workflow introduces a distinct authorization problem: authority must remain valid across a long-running business process without turning into standing privilege. The process may pause for hours or days, cross multiple approvers.
What Can Go Wrong?
- Approval for one amount is reused for a larger purchase.
- Approval for one vendor or item is applied to another.
- The agent exceeds an employee's purchasing authority or organizational spending limits.
- A paused workflow resumes after price, vendor, policy, or approval conditions have changed.
- Standing procurement credentials remain available between workflow steps.
- Vendor-provided content manipulates the agent's recommendation or action.
- A generic service identity obscures who requested and approved the transaction.
What Controls Should Apply?
- Bind authority to a specific requisition or business purpose.
- Preserve the employee, agent, approvers, and resulting transaction as one authority chain.
- Apply explicit limits by amount, vendor, category, geography, cost center, or transaction.
- Treat approval as bounded authorization rather than a generic permission to proceed.
- Separate research, requisition, approval, and purchase execution.
- Reevaluate authorization after pauses and when material transaction details change.
- Acquire short-lived credentials for each required action.
- Prevent approval from being replayed or reused for another transaction.
- Record which decisions were autonomous and which were explicitly approved.
Powered by
Quick access
Sign Up for Updates
Identity-obsessed? Want to keep up with the Identity Universe?
Sign up to receive the latest news from Aembit!
Sign up to receive the latest news from Aembit!