The next big shift in AI security is this: authentication is no longer enough once agents can change their own power at runtime.
An agent can be fully authenticated and still become unsafe minutes later. This can be referred to as capability drift, and the answer to it as capability attestation.
We design roles and permissions at the point of creation. We draw our trust boundaries at the configuration stage, and believe them to be static.
Agentic systems force a different question: what was this system capable of doing at the exact moment it acted?
That distinction matters because modern agents do not stay fixed. Often by explicit request or permission, they acquire tools at runtime, invoke sub-agents, operate across organisational boundaries, and act through delegated roles.
This is the cause of the capability identity gap. The system’s identity remains valid even as its real capabilities change underneath the surface.
That is why I think capability attestation and drift detection will become a foundational security pattern for agentic systems.
The problem is architectural
Inside the model, tool definitions and user context are both just tokens. At the orchestration layer, they have completely different security implications. Context influences what the agent chooses to do. Capabilities determine what it is actually able to do.
If those two are conflated, you get silent capability escalation: new tools, modified tools, or substituted models that do not invalidate identity or trigger existing controls. That is a major shift from classical IAM.
What can you do?
One answer is to make capability changes cryptographically visible:
- bind an agent’s approved toolset to a signed manifest hash
- invalidate trust when the active capability set changes
- issue short lived identities at session or tool granularity
- verify delegation chains across agents and services
This moves security from identity centric to capability centric, with an auditable trail of:
- which tools were active
- which permissions were inherited
- which model or variant actually executed
- which delegation path led to the action
- whether the capability set drifted after authorisation
Identity tells you who the agent is. Capability attestation tells you what the agent could actually do. Drift detection tells you when that answer changed.
This feels like one of the clearest security architecture shifts required for agentic AI.