Is "IAM for AI agents" actually a distinct problem, or just RBAC with extra steps?

I keep running into a failure pattern that doesn't fit neatly into either "security" or "AI accuracy" discussions, and I want to sanity-check my thinking against people who've actually hit this. The setup: an AI agent (RAG copilot, multi-tenant support bot, internal tool-calling agent) is authorized to access a resource , the permission check passes, nothing crashed, no error. But the specific data it returns or the action it takes is still wrong in a way that's dangerous: A support AI pulls a data - it retrieves the wrong linked account's balance, not because access was denied, but because the query resolved to the wrong entity within data the user was legitimately allowed to touch. An orchestrator spins up a subagent for a subtask, and the subagent inherits (or worse, expands) permissions no one explicitly granted it. An agent has technical access to run a destructive action (delete, write) that it was never meant to execute autonomously, even though the credential itself is valid. Questions Has anyone here seen this exact failure in production? Is this already solved by something I haven't found, or is everyone just eating the risk because gateways/IAM tools don't cover it? Is this like a gateway level problem?