Agentic identity governance is reshaping enterprise access control

At a glance

What this is: This is an executive viewpoint on agentic identity governance, arguing that access control must adapt as software moves from advice to action and as human, machine, and agent identities converge.

Why it matters: It matters because IAM and IGA teams need to rethink how access is governed when software can initiate, complete, and learn from workflows without waiting for human approval.

By the numbers:

• In Q2 2025, the 18 largest cybersecurity vendors grew 14.6%, outpacing overall IT spend at 8% and GDP at 2%.
• More than 70% of breaches use identity techniques.

Context

Agentic identity governance is the discipline of deciding what software can access, what it can do, and how long that access should last when the software can act independently. The problem is no longer limited to human users and service accounts; it now includes agents that can plan, call tools, and complete workflows.

Lumos frames the issue as a scaling problem in identity governance rather than a pure AI feature story. Manual access reviews, spreadsheet-driven role design, and ticket-based approvals were already strained by SaaS sprawl, and the article argues that agentic software pushes those control models beyond their operating assumptions.

The article’s central claim is that the access surface has expanded faster than the teams responsible for governing it. That is a typical pressure pattern for modern enterprise identity programmes, but the shift from human-paced access to machine-paced decision loops makes the gap materially harder to close.

Key questions

Q: How should security teams govern agent workflows at runtime?

A: Security teams should govern agent workflows with controls that evaluate prompts, tool calls, and outputs during execution, not only after deployment. Runtime checks matter because risk can appear at each stage of the workflow. The goal is to stop unsafe behavior before it becomes an executed action or a leaked response.

Q: Why do traditional access reviews fail for agentic enterprise identity?

A: Access reviews assume permissions remain stable long enough to be sampled and certified later. Agentic systems can create, use, and retire access in a much shorter window, so the control misses the decision point and leaves no durable state to review.

Q: What breaks when RBAC is used for autonomous software?

A: Static roles become too slow and too coarse when software adapts its path at runtime. RBAC can still describe baseline permissions, but it cannot by itself constrain tool choice, workflow sequencing, or short-lived task execution well enough for agentic systems.

Q: How do human IAM, NHI governance, and agent identity differ in practice?

A: Human IAM focuses on user authentication and role assignment, NHI governance focuses on service credentials and lifecycle control, and agent identity adds runtime decision-making that can change how access is consumed. A mature programme has to govern all three without treating them as the same identity type.

Technical breakdown

Why manual access governance breaks under agentic workflows

Traditional identity governance assumes access changes are discrete, human-paced events: someone requests access, someone approves it, and someone later reviews it. Agentic software collapses those steps into a runtime loop. If an agent can infer context, call tools, and complete work end to end, then governance is no longer about periodic certification alone. It becomes a question of what can be issued, under which policy, and with what boundaries before the workflow starts. That changes the control point from after-the-fact review to runtime authorisation and evidence capture.

Practical implication: move governance decisions closer to issuance and execution, not just quarterly review.

RBAC, birthright access, and policy drift in agentic environments

Role-Based Access Control works when roles remain relatively stable and the organisation can define common access patterns in advance. The article highlights the opposite condition: AI-driven systems learn, adapt, and operate against changing business context. That makes static role definitions drift quickly, especially where approval paths and job functions evolve faster than policy refresh cycles. In practice, the issue is not that RBAC becomes useless, but that it becomes incomplete when applied to systems that change behaviour dynamically and may need permissions tied to task scope rather than job title.

Practical implication: separate durable human roles from task-scoped agent permissions and review both on different cadences.

How agent identity changes the meaning of access control

The article treats agents, bots, and service accounts as part of the same expanding access surface, but agents introduce a stronger governance problem because they can make choices at runtime. A non-human identity is usually governed as a credential or workload. An agentic identity also behaves as a decision-making system that can select tools, sequence actions, and adapt to feedback. That means the real question is not only whether the identity is authenticated, but whether its allowed action space is bounded tightly enough to prevent unintended workflow completion. This is why agent identity security cannot be reduced to secrets management alone.

Practical implication: define action boundaries for agent identities, not just credential controls.

Threat narrative

Attacker objective: The attacker wants trusted access that can be turned into broad control over enterprise data and systems.

1. Entry occurs when attackers target identity rather than perimeter controls, using account takeover or help-desk deception to obtain valid access.
2. Credential access then enables the attacker to sign in through trusted systems and inherit legitimate privileges instead of exploiting a single application flaw.
3. Escalation follows when the compromised identity is used to reach higher-value systems, expand permissions, and move across connected environments.
4. Impact is achieved when the attacker accesses sensitive data, administrative controls, or business processes that depend on trusted identity paths.

Breaches seen in the wild

• SAP Kubernetes secrets exposure 2023: Kubernetes secrets committed to GitHub exposed 203 valid registry credentials, including SAP artifact repository access. SAP closed it after Aqua's report.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic identity governance is an access-control problem, not an AI feature problem: the control objective changes when software can finish work instead of merely recommending actions. Identity teams are no longer governing static entitlements alone; they are governing runtime authority across humans, services, and agents. That means access policy has to be expressed in terms of task boundaries, evidence, and revocation logic, not only role catalogs. Practitioners should treat agentic identity as a governance model shift, not a new checkbox in IAM.

Manual review cycles do not scale to decision loops: the governance model that works for quarterly certification assumes privileges persist long enough to be seen, reviewed, and revoked. Agentic systems can request, use, and discard privileges within a single workflow, which breaks that assumption structurally. The implication is that access review remains necessary but no longer sufficient; the decisive control becomes how access is issued, bounded, and logged at the moment of use.

RBAC needs to be complemented by task-scoped authorisation: static role design was built for relatively stable job functions, not for software that adapts its path mid-execution. When an agent can infer context and choose tools at runtime, the governance challenge shifts from mapping users to roles to constraining what a given identity may do inside a specific objective. Practitioners should expect role models to remain useful for humans while becoming too blunt for autonomous execution paths.

Agent identity security now spans human IAM, NHI governance, and autonomous decision-making: the article is pointing at a convergence, not a replacement. Human users still need access management, service accounts still need lifecycle governance, and agents now add a layer of independent action on top. That overlap is where governance gets hardest, because one programme has to cover three different identity behaviours without collapsing them into a single control pattern. Security teams should organise by behaviour, not by buzzword.

Identity blast radius is now defined by workflow reach, not just privilege count: an agent with modest permissions can still create outsized impact if it can chain tools, call APIs, and complete business processes end to end. The named concept matters because it reframes risk from raw access volume to the operational span of an identity. Practitioners should assess how far a compromised or misused identity can travel through workflows, not only how many entitlements it carries.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Agentic identity changes the control point: access governance cannot stop at provisioning and quarterly review when software can request, use, and release permissions inside one task. Practitioners need controls that decide and record access at execution time, not only after the fact.

The governance question is now behavioural as much as structural. Human roles, workload identities, and agentic actors should be governed separately because the same permission model does not describe how each one actually consumes access.

For practitioners

• Define task-scoped agent permissions Map each agentic workflow to the smallest viable action set, including tool use, data access, and approval boundaries. Separate these from human roles so a change in one does not silently expand the other.
• Move governance checks to issuance time Add policy checks before an agent receives access, and require runtime evidence for any action that crosses a sensitive boundary. Do not rely on post-execution review alone when workflows can complete in one session.
• Split RBAC for humans from policy for agents Keep role design for people, but govern agents through scoped objectives, allowed tools, and explicit revocation conditions. This prevents static role models from being reused where adaptive behaviour makes them too coarse.
• Instrument agent actions for auditability Log which identity requested access, which tool was called, what data was touched, and which policy decision allowed it. Audit evidence should show the full action chain, not just the final outcome.
• Reassess lifecycle controls across all identity types Review onboarding, access changes, and offboarding for humans, service accounts, and agents together so lifecycle gaps do not appear at the boundaries between programmes.

Key takeaways

• Agentic software turns identity governance into a runtime control problem because access can be consumed before traditional review cycles see it.
• The article ties the shift to broad enterprise change, including the growth of human, machine, and agent access across the same environment.
• Practitioners should separate human role design from agent task boundaries and treat evidence, revocation, and auditability as execution-time requirements.

Key terms

• Agentic Identity Governance: The discipline of managing, governing, and auditing the identities of autonomous AI agents across their full lifecycle, from provisioning with least-privilege credentials through continuous monitoring and decommissioning. An emerging sub-discipline of NHI governance.
• Task-scoped Authorization: Task-scoped authorization limits an AI agent’s access to the specific data, tools, and actions needed for one bounded objective. It is a stronger fit than static role assignment when the system’s behaviour can change during execution and when overreach creates immediate business risk.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.