How should organisations use agentic AI in identity governance without losing control of approvals and access policies?

Organisations should place agentic AI inside a human-in-the-loop governance model, where the system can recommend, draft, and execute routine steps only within defined guardrails. Access decisions still need policy checks, approval thresholds, audit trails, and exception handling. The goal is to increase speed and consistency without giving the agent unrestricted authority over identity and access outcomes.

Why This Matters for Security Teams

Agentic AI can accelerate identity governance only when it is treated as a controlled operator, not a policy owner. The risk is not just bad recommendations. An agent with tool access can draft access changes, chain approvals, and act on stale context faster than a human reviewer can intervene. That makes governance quality depend on runtime checks, approval thresholds, and revocation discipline. Current guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward human oversight, but identity teams still need to translate that into practical access control.

This is especially important because identity workflows already concentrate risk. In NHIMG research, Ultimate Guide to NHIs reports that 97% of NHIs carry excessive privileges and only 20% of organisations have formal offboarding and revocation processes for API keys. If an AI agent can request, approve, or execute access actions without bounded authority, those weaknesses become a force multiplier rather than a background hygiene issue. In practice, many security teams discover the control gap only after an agent has already created risky access paths or accelerated an existing approval backlog.

How It Works in Practice

Organisations should place agentic AI inside a workflow where it prepares work, but the policy engine decides what is allowed. The safest pattern is to separate three functions: recommendation, authorization, and execution. The agent can analyse requests, map them to roles or entitlements, and draft approvals. A policy service then evaluates the request in real time, using context such as requester identity, asset sensitivity, time, location, and ticket state. Only then should an execution step occur.

That model aligns with the operating logic described in OWASP NHI Top 10 and the CSA MAESTRO agentic AI threat modeling framework. It also fits the direction of modern Zero Trust programs, where trust is evaluated continuously rather than granted once. For identity governance, that means:

• Use human-in-the-loop approval thresholds for privileged, high-risk, or policy-breaking access.
• Issue just-in-time permissions for a specific task, with short TTLs and automatic revocation.
• Keep the agent on workload identity, not shared admin accounts or long-lived secrets.
• Log the full decision path, including prompts, policy matches, approver identity, and execution outcome.
• Block the agent from modifying its own guardrails, approval rules, or exception lists.

For implementation detail, the identity of the agent should be proven cryptographically at runtime, then mapped to a constrained workload role. Standards such as OWASP Non-Human Identity Top 10 and NIST Cybersecurity Framework 2.0 reinforce the need for least privilege, monitoring, and response. These controls tend to break down when an organisation lets the agent operate across disconnected IAM, ticketing, and secrets systems because policy context is lost between steps.

Common Variations and Edge Cases

Tighter approval controls often increase workflow latency, so organisations have to balance speed against risk tolerance. That tradeoff becomes most visible in low-risk, high-volume requests, where full manual review can create bottlenecks and prompt shadow processes. Current guidance suggests using policy tiers rather than one universal approval path, but there is no universal standard for this yet. Some environments can safely allow auto-approval for low-impact changes, while privileged changes should remain human-approved.

Edge cases matter most when the agent operates across multiple tools or multiple business units. A single agent may have enough context to recommend an entitlement, but not enough authority to execute it end-to-end. In those cases, the safest design is to let the agent draft the change and present evidence, while a human or policy service makes the final call. This is also where audit quality matters: teams should be able to reconstruct why an access grant happened, what policy was checked, and whether any exception was used. NHIMG’s 52 NHI Breaches Analysis shows how often identity failures are amplified once machine accounts are over-trusted, and the same pattern can emerge with agentic workflows if guardrails are too loose.

Best practice is evolving, but the practical rule is stable: let agentic AI accelerate decision support, not own the decision authority. When approval logic, policy evaluation, and secret issuance become entangled, teams lose the ability to prove who authorised what, and the control model collapses under scale.

Related resources from NHI Mgmt Group

• How should organisations use AI agents in access reviews without losing governance control?
• How should governance teams put AI agents into production without losing control over approvals and access?
• How should organisations use identity governance partners to modernise access programmes without weakening control boundaries?
• How should identity teams use conversational AI to investigate identity risk without losing control over approvals and remediation?