Delinea has added a new layer of security that lets enterprise teams approve or block an AI agent’s actions in real time—after authentication but before the agent touches a production database, changes a cloud configuration, or runs a command on a server. The capability, now part of the Delinea Platform, marks a shift from trusting an agent at login to scrutinizing every tool call, database query, and shell command it attempts during an active session.

The announcement, reported July 29 by Channel Insider, addresses a problem that has quietly grown as autonomous AI agents spread across corporate IT. These agents don't work like a human administrator who logs in, does a few things, and logs out. They can fire off dozens of API requests, database mutations, and infrastructure changes in a matter of seconds. A single overly broad prompt or a poisoned dataset could send an authenticated agent on a spree that traditional privileged access management (PAM) tools were never built to stop.

From front-door guard to in-room supervisor

Before this update, most PAM solutions worked like a bouncer at a club: they checked your ID at the door and, if it looked valid, let you in. What you did after that was largely your own business—logged after the fact, perhaps, but not interrupted. For human operators, that model had its flaws, but humans are slow and usually deliberate. For AI agents, it's a disaster waiting to happen.

Delinea's new runtime authorization flips the script. When an agent connects, the platform first determines whether the incoming request comes from a human or an AI agent. Then, for AI agents, it begins an entirely different kind of session monitoring. Every tool the agent tries to use, every command it wants to run, every query it aims to execute can be approved automatically, denied outright, or escalated to a human for a decision. This isn't a recording you watch after something breaks; it's an active checkpoint that can say "no" before the damage occurs.

The system also introduces just-in-time credentialing for agents. Instead of giving an agent a standing privileged account that it can use whenever, the platform issues a temporary credential at the moment of access, scoped only to the specific task at hand. Once that task finishes, the credential vanishes. Even if an agent goes rogue or gets tricked, the window for harm is drastically narrowed. For example, an agent built to restart a Windows service might get a credential that allows just that action on a specific server, not the ability to traverse the network or modify Active Directory groups.

And crucially, every action an agent takes gets attributed back to a named identity. That means if an agent acting on behalf of "Jane Developer" runs a destructive query, the audit trail doesn't just say "Agent-42 did it"; it ties the event to Jane. For compliance, forensics, and incident response, that traceability is essential.

Who this matters for, and why

This isn't a feature for the home office. It's squarely aimed at enterprises, managed service providers, and anyone running autonomous AI agents in production environments. Let's break down what it means for different roles.

For security teams and IAM administrators

If you're already managing privileged access for humans, AI agents are now a second, faster-moving user population you can't ignore. The primary win here is that you can write policies that treat agent actions differently from human ones. Risk rules that might be too draconian for people—like requiring manual approval before any command that touches a production database—can be applied to agents without slowing down human workflows. You can also enforce a principle of least privilege more granularly: an agent that monitors logs might only need read access, while one that auto-remediates might need restart rights on a service, but definitely not delete rights.

For Windows-focused teams, the scenarios are immediate. An agent tasked with monitoring Windows Server event logs should never be allowed to open a remote PowerShell session without a human saying yes. A policy can be set to auto-approve read-only operations via Windows Admin Center but block any attempt to change a registry key or stop a critical service until an admin reviews it. This granularity means you can finally let an agent touch your core Windows infrastructure without handing it the digital equivalent of a master key.

The attribution piece also simplifies life. When a compliance auditor asks "who deleted that customer record," you can point to the agent and the human or service account behind it, with a full chain of approvals.

For DevOps and cloud engineers

You're likely the ones deploying these agents in Kubernetes clusters, cloud consoles, and CI/CD pipelines. Delinea's controls integrate directly into those environments. Rather than baking authorization logic into each agent yourself—a maintenance nightmare—you can offload it to a central policy engine. The platform supports SSH hosts, cloud consoles, and Model Context Protocol (MCP) servers, so it covers common agent touchpoints.

The just-in-time credential approach also means you don't have to rotate secrets as aggressively because there are fewer long-lived credentials to steal. If an attacker compromises an agent, they get a credential that's already expired or about to be revoked.

For MSPs and MSSPs

Managed service providers face a multiplier effect: they're not just wrangling agents in their own infrastructure but across dozens or hundreds of customer environments. Delinea's centralized runtime enforcement could let you define a set of common guardrails—"no agent may alter firewall rules without human approval"—and apply them consistently across tenants. That doesn't mean the work is done. You'll still need to inventory which agents exist, map their intended workflows, and figure out who can approve exceptions. But having a single pane of glass to do so beats managing a patchwork of per-customer scripts.

Why the old security playbook doesn't work for AI agents

The problem Delinea is solving didn't appear out of nowhere. Over the past few years, organizations have rushed to deploy AI agents that can order supplies, provision cloud resources, answer customer queries by querying live databases, and even write and deploy code. These agents are often given broad credentials because it's the easiest way to get them working.

Traditional identity security has focused heavily on credential hygiene: protect the secret, rotate it, vault it. But as Delinea's CEO Art Gilliland put it, "You can have perfect credential hygiene and still watch an agent tear through your production environment in milliseconds. Recording what happened or revoking access after the fact doesn't stop that—enforcing policy on the action as it runs does." That quote cuts to the heart of the shift: the attack surface has moved from the perimeter of the session to the actions inside it.

Existing point solutions have offered some guardrails. Tools that scan for misconfigurations or detect anomalous behavior in logs can flag that an agent did something suspicious, but only after the fact. Runtime controls that block actions in real time are the logical next step—and a harder engineering challenge. Delinea's announcement suggests the industry is starting to treat agentic access not as a human analog but as a fundamentally different problem.

The emergence of the Model Context Protocol (MCP) is another factor. MCP provides a standard way for agents to connect to tools and data sources. As agents add more MCP servers, the number of machine identities and potential abuse paths multiplies. Delinea explicitly mentions support for MCP servers, which signals they're trying to get ahead of that curve.

Your move: practical steps for bringing AI agents under control

If your organization is already deploying AI agents or planning to, this announcement should trigger a review, not a panic. Here's a practical playbook.

1. Take an inventory of every AI agent with access to sensitive systems.
You can't protect what you can't see. List out all agents running in production, what they're supposed to do, and what credentials they possess. Don't forget agents embedded in SaaS platforms or created by "citizen developers."

2. Classify agent actions by risk.
Not every action is equal. Reading logs is low risk. Restarting a service is moderate. Deleting data, changing permissions, or altering infrastructure is high. Use that classification to decide what needs runtime approval.

3. Evaluate whether your current PAM or identity platform can enforce action-level policies.
If you're already a Delinea customer, reach out to understand how to turn on these new controls. If you're using another vendor, ask them about their roadmap for AI agent runtime authorization. This capability is likely to become table stakes within the next 12 to 18 months.

4. Start with just-in-time access for the highest-risk agents.
If you can't implement full runtime control immediately, at minimum ensure that agents don't have standing credentials. Delinea's approach shows that short-lived, task-scoped credentials drastically reduce the blast radius of a compromised agent.

5. Design an approval workflow that doesn't become a bottleneck.
The whole point is to stop the bad while letting the good flow. If every database query pings a human for approval, your automation becomes useless. Use automatic approval for low-risk, well-defined operations, and reserve manual escalation for changes that could cause outages or data loss. Over time, you can tune these policies based on observed patterns.

6. Extend these controls to third-party agents.
Many enterprises use agents from vendors like Microsoft (Copilot), Salesforce, or other platforms that are starting to act autonomously. Insist that your vendors provide or integrate with runtime authorization mechanisms. The Delinea platform's ability to distinguish human from agent connections could be a model for how third-party tools plug into your central policy.

What happens next

Delinea's move is unlikely to be the last. Expect other privileged access management players—CyberArk, BeyondTrust, HashiCorp—to follow with their own versions of runtime authorization for AI agents. Cloud providers like AWS, Azure, and Google Cloud will likely build similar capabilities into their native identity services, if they haven't started already.

The conversation around AI security is also maturing from "discover and inventory machine identities" to "enforce real-time, per-action governance." That's a good thing. It means the industry is acknowledging that these agents operate on a different clock than humans and need security controls that match their speed. For Windows and enterprise administrators still getting comfortable with the idea of AI agents, the message from Delinea is clear: you can trust them to do their job, but you need a way to say "stop" the second they step out of line.