NHI & Agentic AI Identity Security FAQ

Question 1

Why do consumer accounts need different IAM controls from workforce identities?

Accepted Answer

Consumer identities operate at much larger scale, with higher volatility, more self-service, and far less direct administrator oversight. That changes the control model. B2C CIAM has to handle registration, consent, social login, and account recovery in ways that support customer journeys while still resisting fraud and takeover attempts.

Question 2

Why do online portals matter so much in customer identity programmes?

Accepted Answer

Portals are where customers experience whether identity design actually works. If access, recovery, and session handling are clumsy, users often read that as a lack of reliability or control. Strong portal design improves service confidence because it gives customers a clear, repeatable way to view and manage their own data.

Question 3

How can practitioners tell whether their team is reading deeply enough?

Accepted Answer

A useful test is whether the team can explain the mechanism, the assumptions, and the limits of a recommendation in its own words. If it cannot, the team is probably consuming information faster than it is understanding it.

Question 4

Why does Active Directory still matter to modern identity programmes?

Accepted Answer

Active Directory still matters because it often acts as the authoritative control plane for authentication, group-based authorisation, and privileged administration. When directory trust is centralised, its availability and integrity affect user access, service accounts, and recovery operations across the enterprise. Identity teams should treat it as core security infrastructure, not an ageing back-office service.

Question 5

What breaks when purchases and identity are not unified across channels?

Accepted Answer

When purchases and identity are not unified, users can buy value on one channel and fail to see it on another, which looks like fraud or product failure from their perspective. Support teams then inherit the inconsistency, and trust drops quickly. Unified identity is what keeps entitlements recognisable across devices.

Question 6

Why do customer identities need different controls from workforce identities?

Accepted Answer

Customer identities behave at much larger scale and under far less organisational context than workforce identities. That changes recovery, assurance, privacy, and user-experience requirements. A control that works for an employee can create abandonment or compliance issues for a customer, so the design must reflect the identity subject and the business outcome.

Question 7

Why do RAG systems need more than a single quality score?

Accepted Answer

A single score can hide whether the retriever failed, the generator hallucinated, or the answer was correct but poorly explained. Separate signals for grounding, relevance, and retrieval quality help teams identify the real problem and avoid fixing the wrong layer of the pipeline.

Question 8

What should teams do when an MCP server is updated or replaced?

Accepted Answer

Treat the change like an identity lifecycle event. Revalidate the server’s permissions, review tool descriptions and command paths, re-sign or re-approve the component if needed, and confirm that old access paths are removed before the new version is trusted.

Question 9

How do organisations reduce risk when third-party agents require repeated sign-in?

Accepted Answer

They should treat repeated sign-in as a signal to tighten lifecycle control, not as a user inconvenience to accept. Every per-user, per-tool OAuth flow expands token sprawl and revocation complexity. Organisations should centralise authorization visibility, shorten the time to revocation, and ensure that every connected token has a clear owner and offboarding path.

Question 10

How do security teams reduce credential sprawl in MCP deployments?

Accepted Answer

Keep secrets in encrypted storage, separate key management from the application database, and avoid distributing API keys or tokens across laptops, config files, and environment variables. MCP deployments need a managed secrets boundary because scattered credentials create hidden access paths that are hard to revoke and harder to audit.

Question 11

When should organisations tie remediation into IAM and NHI lifecycle controls?

Accepted Answer

Any time a finding touches credentials, privilege, or workload access, remediation should map to lifecycle actions such as revocation, rotation, offboarding, or entitlement adjustment. That keeps the fix aligned to the access model rather than a one-off operational change.

Question 12

How should mobile security teams reduce secret exposure in Android apps?

Accepted Answer

Prioritise shortening the time secrets are visible, then bind visibility to app lifecycle state. If an authentication code or recovery value must appear, hide it whenever the app is backgrounded or covered, and test the behaviour across devices and OS versions. That approach reduces the attack window even when screenshot controls are bypassed.

Question 13

What breaks when MCP revocation does not reach the underlying OAuth token?

Accepted Answer

You get partial offboarding. The MCP layer may say access is closed, but the token can still work against the target service, which leaves hidden standing privilege and makes incident response slower because the true credential path is still live.

Question 14

How should organisations respond when generated code can create or handle service accounts?

Accepted Answer

They should extend NHI lifecycle controls into the software delivery pipeline. That means requiring ownership for every account or key the code touches, enforcing rotation and revocation workflows, and preventing unreviewed credential creation from reaching production.

Question 15

What breaks when a Kubernetes-hosted MCP server is exposed through a tunnel without scoped authorization?

Accepted Answer

The main failure is that network reachability becomes confused with permission. A public tunnel can make an internal MCP server reachable, but without tool-level scoping, any caller with the edge credential may invoke more capability than intended. That creates a wider blast radius than the operator usually expects.

Question 16

Why does MCP create the same kind of sprawl as NHI programmes?

Accepted Answer

Because every server can introduce its own client registration, token store, and refresh logic, which multiplies credential-bearing assets without a common governance model. That is the same structural problem seen in NHI sprawl: more identities, more exceptions, and less visibility. The issue is not the protocol alone, but the way it fragments control.

Question 17

What is the difference between local MCP auth and a shared control plane?

Accepted Answer

Local auth repeats the same OAuth logic inside each server, while a shared control plane centralises policy, token handling, and revocation. The difference matters because one model scales identity governance, and the other scales fragmentation. For enterprise use, the shared model is the one that creates a manageable audit boundary.

Question 18

Why do mobile tokens create identity governance risk even after login succeeds?

Accepted Answer

Tokens extend trust beyond the initial authentication event, so weak storage, over-scoping, or poor revocation turns one login into a reusable identity artifact. That creates governance risk because the token may outlive the user intent, the device trust state, or the original session boundary. Good controls limit scope, lifetime, and replay value.

Question 19

How should security teams handle identity in MCP servers that call backend tools on behalf of users?

Accepted Answer

They should preserve user context end to end by using short-lived tokens, token exchange, or federation instead of shared service credentials. That lets the backend see a scoped identity tied to the originating user, which improves attribution, reduces blast radius, and makes access reviews meaningful.

Question 20

How do token exchange and federation help with least privilege in AI toolchains?

Accepted Answer

They let the system mint a backend token that is narrower than the original session and valid only for the intended audience. That means the front-end login can remain user-friendly while the backend still receives only the permissions required for the specific call.

Question 21

How do IAM and NHI programmes reduce secrets sprawl without slowing delivery?

Accepted Answer

Use workload identity, runtime injection, and environment-based segmentation so credentials are issued only when needed and only where needed. That preserves developer velocity while shrinking the number of places a secret can leak or be reused.

Question 22

Where should teams look first when secrets incidents are not coming from repositories?

Accepted Answer

Start with collaboration platforms, ticketing systems, build logs, and configuration files. Those places often carry pasted credentials, temporary access values, or deployment secrets that never reach a formal vault. If those systems are outside policy, your secrets programme is blind to a large part of the leak surface.

Question 23

Why do secrets keep reappearing even when organisations already scan for leaks?

Accepted Answer

Because scanning only finds exposure after the fact, while the underlying creation habits remain in place. Developers paste values into code, configs, chats, and pipeline files when workflows make that path easy. Real reduction comes from guardrails, validation, and automated remediation across the whole delivery chain.

Question 24

How should teams govern architecture drift when AI agents can change code continuously?

Accepted Answer

Teams should turn architectural intent into automated policy checks that run on every change, not periodic reviews. That lets them catch dependency violations, trust path expansion, and layering drift while the code is still moving, which is the only point where governance can keep pace with agentic delivery.

Question 25

What breaks most often during IAM platform migration?

Accepted Answer

The usual failures are hidden application dependencies, incomplete federation configuration, mismatched session handling, and policy drift between old and new systems. These issues often appear only after users are moved, which is why staged validation is more reliable than a big-bang switch.

Question 26

How do you know an IAM migration is ready for production cutover?

Accepted Answer

You know it is ready when every critical dependency has been tested, rollback has been exercised, and the support model is clear. If any authentication path, policy rule, or lifecycle step still depends on assumptions rather than evidence, production is not ready.

Question 27

How should teams use architecture maps to reduce refactoring risk?

Accepted Answer

Use them to identify dependency hot spots before large changes land. Look for long chains, cross-layer calls, and highly connected utilities, then sequence refactoring so the most coupled areas are addressed first. That reduces the chance that a local code change triggers widespread regression or ownership confusion.

Question 28

How should organisations control access to data used in RAG pipelines?

Accepted Answer

Apply least privilege to every retrieval connector, service account, and API token that can surface source content into the model. Review those credentials on the same cadence as the evaluation process, because unbounded access can quietly expand the system's trust boundary. Where possible, pair access reviews with trace logging.

Question 29

Who is accountable when an incident is caused by delayed access revocation?

Accepted Answer

Accountability should sit with both the operational owner of the access path and the governance function that defines revocation rules. Incident teams can execute containment, but IAM, PAM, or application owners usually control the lifecycle policies that determine how fast access can be removed. Without shared ownership, response metrics become reporting data instead of control evidence.

Question 30

What breaks when CSAM moderation workflows rely on informal access controls?

Accepted Answer

Informal access controls usually fail at the handoff points. Analysts may see more case data than they need, evidence can be handled inconsistently, and partner escalation may leave no defensible audit trail. The result is slower takedown, weaker accountability, and higher exposure for both reviewers and sensitive material.

Question 31

Why do trust and safety teams need identity governance for reviewer access?

Accepted Answer

Because sensitive moderation work depends on who can view, classify, escalate, and preserve evidence. Without identity governance, access can become permanent, external partners can be over-scoped, and case handling loses traceability. Least privilege and time-bound access reduce both misuse risk and accidental exposure.

Question 32

Who is accountable when content takedown spans multiple hotlines and platforms?

Accepted Answer

Accountability must be split by function, not blurred by partnership. The platform, the hotline, and any external reviewers should each have defined decision rights, logging obligations, and retention rules. If everyone owns the outcome, no one owns the control failures that appear along the chain.

Question 33

How do organisations know whether CSAM response controls are working?

Accepted Answer

Look for consistent case resolution times, complete escalation logs, tightly scoped reviewer permissions, and low variance in takedown decisions across teams. If reviewers are regularly reassigned outside approved workflows or evidence records are incomplete, the control environment is too weak to trust.

Question 34

Who should own security when a model gateway is used for production AI?

Accepted Answer

Ownership should sit across IAM, PAM, platform engineering, and AI governance because the gateway touches credentials, spending, model access, and incident recovery. Treat the gateway as part of the non-human identity perimeter. If one team owns only routing, no single owner can enforce the full control set.

Question 35

Who is accountable when a hijacked agent uses stolen credentials?

Accepted Answer

Accountability sits with the team that owns the workload identity, the secret lifecycle, and the runtime controls around the agent. If the agent could read mounted tokens, environment variables, or service account credentials, then the failure is governance as much as detection. Access scope, secret exposure, and monitoring should all have named owners.

Question 36

What breaks when a trusted developer extension can auto-update into malware?

Accepted Answer

The trust model breaks at the point where an editor can execute code before review or containment. A malicious extension can use the same user session that developers rely on for source control, cloud access, and package publishing, turning convenience into credential exposure. Security teams need version gating, staged rollout, and host-level monitoring for extension behaviour.

Question 37

How do security teams know if extension compromise has turned into wider identity abuse?

Accepted Answer

Look for impossible combinations of signals, such as unexpected secret reads, new package publishes, unfamiliar GitHub API use, cloud token reuse from developer hosts, and access from endpoints that should never touch production identities. The key signal is not one alert but a sequence that shows stolen credentials being reused across systems.

Question 38

Who is accountable when a poisoned extension steals publishing or cloud credentials?

Accepted Answer

Accountability sits with the teams that own endpoint control, developer tooling governance, and identity lifecycle management for the affected secrets. If an extension publisher account, developer session, or build identity was not segmented and monitored, the control gap is organisational, not just technical. Recovery must include revocation, audit, and governance review.

Question 39

Why do npm tokens and build credentials increase supply chain risk so quickly?

Accepted Answer

Because they are reusable non-human identities with privileges that outlive a single session. If an attacker steals a token that can publish packages or write automation, the compromise can spread from one repository to many others, turning a local infection into ecosystem-wide propagation.

Question 40

Why do distributed AI clusters make deserialization bugs more dangerous?

Accepted Answer

Distributed AI clusters make deserialization bugs more dangerous because orchestration, worker coordination, and cross-process state all rely on privileged paths that are often assumed to be internal. In shared or multi-tenant environments, those paths may still be reachable by untrusted jobs or compromised workers, turning a local flaw into a cluster-wide compromise risk.

Question 41

What breaks when model-serving frameworks deserialize untrusted control-plane data?

Accepted Answer

When model-serving frameworks deserialize untrusted control-plane data, object reconstruction can become code execution instead of data loading. That can let an attacker pivot from a job, worker, or serialized handle into the serving process itself. The failure is not just malformed input, but trust placed in bytes that should never have crossed the execution boundary.

Question 42

Who is accountable when a model-serving control plane is exposed through deserialization?

Accepted Answer

Accountability usually sits with both the platform owner and the engineering team operating the serving stack. Platform owners must define trust zones, identity boundaries, and patch expectations, while engineers must remove unsafe loaders and validate control-plane inputs. Frameworks such as NIST CSF and OWASP NHI help teams assign those responsibilities clearly.

Question 43

Should organisations use both network and identity controls for AI agents?

Accepted Answer

Yes, but only as layered enforcement, not as a complete answer. Identity controls restrict what the agent may access, while network controls restrict where traffic may go. Neither one can determine whether a permitted action is actually safe, so runtime behavioural enforcement still has to fill the gap.

Question 44

What breaks when AI agents rely only on static EKS sandboxing controls?

Accepted Answer

Static controls still approve permitted APIs, ports, and syscalls even when an agent’s runtime behaviour becomes unsafe. The failure is not lack of policy, but lack of behavioural context. AI agents can remain formally authorised while exfiltrating data, overusing allowed endpoints, or changing their access pattern in ways traditional Kubernetes controls cannot detect.

Question 45

How can security teams tell normal AI agent activity from misuse?

Accepted Answer

By building per-agent baselines for API frequency, payload size, destination patterns, and process behaviour, then comparing live activity against those baselines. A single authorised action is not enough to prove safety. The signal comes from the sequence, volume, and context of actions over time.

Question 46

Why do SharePoint MCP deployments increase data exposure risk?

Accepted Answer

Because the connector can return whatever the authenticated user can already see, including sensitive records that were never intended for AI consumption. That shifts the risk from access permission to content propagation. The danger is not the query itself, but the uninspected response entering the AI model context window.

Question 47

How can organisations know if their SharePoint MCP controls are working?

Accepted Answer

They should test whether tool calls are logged, sensitive fields are redacted before exposure, and high-risk actions are blocked or routed for approval. If the team cannot show what the agent touched, what it saw, and what was prevented, the control plane is incomplete.

Question 48

How should security teams govern AI agents that access SharePoint content?

Accepted Answer

They should treat the agent as a non-human identity with delegated reach, then control the retrieval path, the returned content, and any write action separately. Authentication alone is not enough. The practical test is whether the agent can only see task-scoped content and whether sensitive fields are filtered before model ingestion.

Question 49

When should teams centralise AI gateway controls instead of using point tools?

Accepted Answer

Centralise when model routing, MCP access, audit, and policy all need to be managed together. Point tools work for narrow problems, but they fragment identity, logs, and approvals across systems. If multiple teams are building agents or using many model providers, a shared gateway reduces policy drift and makes governance measurable.

Question 50

What breaks when organisations trust caller ID or voice as proof of identity?

Accepted Answer

Caller ID and voice are no longer reliable identity signals because both can be spoofed or cloned. When organisations trust them, attackers can pressure staff into revealing MFA codes, approving payments, or granting access. The failure is not employee negligence alone. It is a control design issue that treats an unverified communication channel as authentication.

Question 51

Why do behaviour-only security scores often miss the real risk?

Accepted Answer

Behaviour-only scoring misses the relationship between action and consequence. A click, policy breach, or login event is not equally dangerous for every user. Without identity and access data, teams cannot tell whether the event came from a low-impact account or a highly privileged one that could accelerate compromise.

Question 52

How should security teams score employee risk when access levels differ?

Accepted Answer

Score behaviour through the lens of identity context. A failed phishing simulation means more when the person has privileged access, data access, or administrative reach. Good scoring models weight the same action differently based on role, entitlements, and threat exposure, so the result reflects potential impact rather than just activity volume.

Question 53

How do teams know if human risk scoring is actually working?

Accepted Answer

Look for fewer high-risk users, better targeting of interventions, and a clear link between score changes and access context. If the platform cannot explain why scores change or show measurable reduction in risky exposure, it is generating activity metrics rather than operational risk insight.

Question 54

How should trust and safety teams handle disinformation campaigns that evolve over time?

Accepted Answer

They should analyse the whole campaign, not just the first post. That means linking related accounts, formats, hashtags, and repost chains so analysts can see how the claim mutates. Single-post moderation is useful for enforcement, but campaign-level correlation is what reveals orchestration, reach, and the real point of amplification.

Question 55

Why do verified or high-trust accounts matter in disinformation control?

Accepted Answer

Because identity signals are credibility signals. When a verified account, institutional page, or recognised persona repeats a false claim, the message inherits authority that content filters cannot easily remove. Teams should therefore treat account integrity, verification, and escalation governance as part of narrative defence, not separate from it.

Question 56

What do platforms get wrong about moderating false narratives?

Accepted Answer

They often review each item in isolation and miss the wider pattern. Disinformation usually succeeds by moving from one format to another, such as article, screenshot, map, and official citation. If those artefacts are not linked together, the campaign looks fragmented and slips past review.