Delinea has added runtime authorization controls for AI agents, aiming to let security teams approve, block, or escalate individual commands, tool calls, and database queries while an agent session is active rather than trusting a successful login as sufficient proof of safety.
As reported by Channel Insider, the new Delinea Platform capabilities are designed for agents connected to sensitive enterprise systems such as production databases, cloud consoles, SSH hosts, Kubernetes environments, and Model Context Protocol servers. The practical shift is from access control at session start to policy enforcement at the moment an agent attempts an action.
Traditional privileged access management was built around a human administrator authenticating, receiving authorized access, and then working inside a session. AI agents can execute a large number of API requests and infrastructure commands in seconds, making a one-time authentication decision a weaker safeguard—particularly if the agent is misdirected by bad data, an unsafe prompt, or an overly broad task definition.
Delinea says its platform first identifies whether an incoming connection belongs to a human or an AI agent, enabling separate policies before the agent begins work. During execution, each request can be permitted automatically, denied, or routed to a human approver.
That design matters most for actions with durable consequences: changing cloud permissions, running destructive database queries, modifying Kubernetes workloads, or executing commands on production hosts. An audit record after the event may help investigation, but it does not prevent the event; a runtime control can stop a risky call before it reaches the target system.
For Windows and enterprise administrators, the relevant test is whether an agent can be constrained to a narrow operational path. A useful policy would permit an automation agent to read Windows Server event logs or restart a named service, for example, while requiring approval before it changes an Active Directory group, deletes data, opens a remote shell, or alters a production configuration.
The company also says it will maintain attribution connecting agent-driven activity to a named identity across supported connection protocols. That could be important for organizations trying to apply existing privileged-access audit, compliance, and incident-response processes to agents that act on behalf of employees or internal services.
Delinea’s approach reflects a growing recognition that AI-agent security is not only about discovering machine identities or protecting secrets. It is also about making per-action authorization enforceable where agents touch real infrastructure.
The immediate question for IT teams is less whether an AI agent can authenticate to a system than whether its next tool call should be allowed to run.
As reported by Channel Insider, the new Delinea Platform capabilities are designed for agents connected to sensitive enterprise systems such as production databases, cloud consoles, SSH hosts, Kubernetes environments, and Model Context Protocol servers. The practical shift is from access control at session start to policy enforcement at the moment an agent attempts an action.
The control point moves inside the session
Traditional privileged access management was built around a human administrator authenticating, receiving authorized access, and then working inside a session. AI agents can execute a large number of API requests and infrastructure commands in seconds, making a one-time authentication decision a weaker safeguard—particularly if the agent is misdirected by bad data, an unsafe prompt, or an overly broad task definition.Delinea says its platform first identifies whether an incoming connection belongs to a human or an AI agent, enabling separate policies before the agent begins work. During execution, each request can be permitted automatically, denied, or routed to a human approver.
That design matters most for actions with durable consequences: changing cloud permissions, running destructive database queries, modifying Kubernetes workloads, or executing commands on production hosts. An audit record after the event may help investigation, but it does not prevent the event; a runtime control can stop a risky call before it reaches the target system.
Just-in-time credentials reduce the blast radius
According to Delinea, agents using the new controls do not need permanent privileged credentials. Instead, the platform can provide a credential only when the agent needs it, restrict it to the defined task, and revoke it when that work ends.For Windows and enterprise administrators, the relevant test is whether an agent can be constrained to a narrow operational path. A useful policy would permit an automation agent to read Windows Server event logs or restart a named service, for example, while requiring approval before it changes an Active Directory group, deletes data, opens a remote shell, or alters a production configuration.
The company also says it will maintain attribution connecting agent-driven activity to a named identity across supported connection protocols. That could be important for organizations trying to apply existing privileged-access audit, compliance, and incident-response processes to agents that act on behalf of employees or internal services.
MSPs will need policies, not just an agent inventory
For MSPs and MSSPs, centralized runtime enforcement could offer a way to operate common guardrails across customer tenants without handing every automation workflow broad standing access. But the technology does not eliminate the operational work: providers will still need to define which agent identities exist, which systems they may reach, what commands constitute high risk, and who can approve exceptions.Delinea’s approach reflects a growing recognition that AI-agent security is not only about discovering machine identities or protecting secrets. It is also about making per-action authorization enforceable where agents touch real infrastructure.
The immediate question for IT teams is less whether an AI agent can authenticate to a system than whether its next tool call should be allowed to run.