AI agent governance is lagging behind enterprise access sprawl

At a glance

What this is: This is an analysis of why AI agents in Microsoft environments are becoming governed access actors, not just tools, and why inventory, ownership, and combined human-agent review are now the control problem.

Why it matters: IAM and GRC teams need to treat AI agents as part of the identity landscape because access, ownership, and segregation-of-duties issues emerge only when human and non-human identities are analysed together.

👉 Read Nexis' analysis of AI agent governance and enterprise access sprawl

Context

AI agents can now sit inside the same Microsoft identity and access fabric as people, holding permissions, application roles, and group memberships. The governance problem is not whether agents exist, but whether organisations can still answer who owns them, what they can reach, and whether those permissions remain appropriate for their purpose.

This is an identity governance problem because separate reviews of humans and agents miss combined risk. When an employee with compliant access can also operate an agent with additional permissions, the resulting access pattern can create a segregation-of-duties issue that neither review would surface on its own.

Key questions

Q: What breaks when AI agents are reviewed like human users?

A: Human review assumes access is stable long enough to be observed, approved, and recertified. Agentic workflows often complete within one session and can change scope mid-execution, so the review cycle arrives too late to matter. The result is a governance gap where the action has already happened before anyone can certify it.

Q: Why do AI agents increase segregation-of-duties risk in identity governance?

A: AI agents can hold roles, permissions, and group memberships that extend a human user’s effective reach. When those access paths are assessed separately, the governance team may miss a conflict that only appears when the human and agent are considered together. The risk comes from composite access, not from the agent alone.

Q: How should organisations assign ownership for AI agents in production?

A: Assign ownership to a named business and technical accountable party before the agent is allowed to act. The owner must be able to approve scope, review behaviour, and respond to exceptions. If the name on the record cannot influence the agent's access or operating rules, the ownership control is not real governance.

Q: How do teams know if AI access is too broad?

A: AI access is too broad when a tool can read, write, and export data beyond the immediate task or when the credential remains valid after the use case changes. Teams should look for persistent tokens, shared access paths, and permissions that survive the original business need. Those are the signs of unmanaged standing access.

Technical breakdown

Why separate human and agent reviews miss segregation-of-duties risk

Segregation of Duties, or SoD, depends on seeing the full chain of authority that a person can exercise. AI agents complicate that model because they can hold permissions, roles, and memberships that are distinct from the human who operates them. If the person and the agent are reviewed separately, the combined access path is invisible, even though the business action is executed through both identities together. The technical issue is not just extra privilege, but split visibility across identity classes. That makes access governance dependent on correlation across human, application, and agent records rather than on a single identity object.

Practical implication: build review logic that evaluates human and agent access together, not in separate certification cycles.

How agent ownership and reach become governance signals

An AI agent becomes governable only when its reach, purpose, and accountable owner are explicit. In Microsoft environments, that means inventorying the agent, identifying what it can access, and mapping who is responsible for its lifecycle. Without that context, an agent is just another technical object with permissions attached, which is not enough for IAM or GRC decisions. The important technical distinction is between existence and accountability: an agent may be active, but still lack a registered owner, a purpose boundary, or a clear entitlement rationale. That is where governance starts to fail in practice.

Practical implication: require a named owner, purpose statement, and access rationale before an agent is allowed into production.

Why access transparency must include the human operator

Agent governance is not a standalone inventory problem. The article describes agents that are operated by human users, which means the effective security subject is the combined access path, not the agent by itself. A human may remain individually compliant while the paired agent introduces broader reach into business systems, Teams, Outlook, or a CRM. That creates a composite identity risk: the action is human-directed, but the privilege may come from the agent. This is why entitlement visibility must include relationships between identities, not just the identities themselves. Otherwise, governance reports understate the true blast radius of access.

Practical implication: correlate operator, agent, application, and entitlement data in one governance view before approving business use.

NHI Mgmt Group analysis

AI agent governance fails when organisations treat agents as technical objects instead of accountable identities. That is the central control error this article exposes. Ownership, entitlement rationale, and relationship visibility are not optional metadata; they are the difference between inventory and governance. The practical conclusion is that AI agents belong inside the same identity governance model as the people who operate them.

Cross-identity SoD is the named concept this article makes unavoidable. Separate reviews can show a compliant employee and a compliant agent while missing the combined transaction path that creates the conflict. That means governance is no longer about only reviewing each identity class on its own. Practitioners need to analyse whether two individually acceptable access sets become unsafe when combined.

AI agent access extends existing IAM assumptions rather than replacing them. The article is right to frame ownership, least privilege, and auditable access as familiar principles, because the failure is not a lack of theory. The gap is operational: governance processes have not been extended far enough to include agent inventory, reach, and operator relationships. The implication is that identity programmes must extend, not duplicate, their control model.

The AI agent health-check pattern signals where the market is heading. Organisations are moving from debating whether agents should exist to asking what baseline governance proves they are under control. That shifts value toward inventories, reach analysis, ownership assignment, and cross-identity review as the minimum viable governance stack. Practitioners should expect agent governance to become a standard identity discipline rather than a separate AI project.

European AI governance obligations add accountability pressure to agent oversight. The article notes that organisations in Europe must meet EU AI Act requirements, which means AI agent governance is not only an IAM concern. For practitioners, this links access governance to broader accountability and risk management expectations. The practical conclusion is that agent oversight must be auditable enough to survive both identity review and regulatory scrutiny.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Top 10 Agentic AI Identity Issues

What this signals

Cross-identity SoD is now the control boundary that matters. Governance that certifies humans and agents in isolation will keep missing the risk created when both can execute the same business process. The programme question is no longer whether agents are allowed, but whether their access can be analysed in the same decision frame as the human operator.

Agent governance should be treated as an extension of IAM and GRC, not a separate AI side project. That framing keeps ownership, least privilege, and access review in the control stack that practitioners already understand. It also avoids creating a parallel process that cannot answer who is responsible when agent access becomes risky.

Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap suggests most programmes are still discovering the control model after the risk has already entered production.

For practitioners

• Inventory all active AI agents Build a dated inventory of agents in the Microsoft environment, including origin, intended purpose, and the systems each one can reach.
• Map combined human and agent access Review employee access and agent entitlements together so that segregation-of-duties conflicts created by paired access are visible before approval.
• Assign ownership before production use Require a registered owner for every agent, then tie that owner to existing governance workflows for accountability and review.
• Constrain agent reach to purpose Compare each agent’s permissions, roles, and group memberships with its stated business purpose and remove access that exceeds that scope.
• Create a governance baseline for agents Use a structured assessment of inventory, reach, ownership, and SoD to establish where agent governance is already weak in the tenant.

Key takeaways

• AI agents are becoming governed access actors, which means identity programmes must track them alongside human users and not as isolated tools.
• The critical exposure is composite access, because separately compliant human and agent entitlements can still create a segregation-of-duties conflict.
• The control answer is not a new parallel model, but explicit ownership, entitlement scope, and joined human-agent review.

Key terms

• AI Agent Governance: AI Agent Governance is the set of policies, controls, and oversight practices used to direct how autonomous software agents behave. It defines allowed actions, approval paths, identity boundaries, logging, monitoring, and accountability so agent decisions remain traceable, constrained, and aligned with business, security, legal, and ethical requirements.
• Cross-App Segregation Of Duties: A SoD approach that evaluates whether a single identity can perform conflicting actions across multiple systems, not just within one application. It is essential in SaaS and cloud environments where business processes span tools and where conflicts often emerge only when permissions are considered together.
• Identity Landscape: An identity landscape is the full set of human and non-human identities, relationships, entitlements, and business contexts that define who or what can access resources. For AI agents, the landscape must include operator relationships and access reach, not just the agent object itself.
• Agent Reach: The total set of files, systems, and connectors an AI agent can inspect or query during a task. In practice, reach defines the real exposure boundary, because broader reach increases the chance that secrets, source code, or regulated data will enter model context.

What's in the full article

Nexis' full article covers the operational detail this post intentionally leaves for the source:

• The Microsoft tenant assessment workflow used to inventory AI agents and map their reach
• The four review areas, including ownership, access concentration, and cross-identity SoD
• The baseline and benchmark outputs intended for technical and management stakeholders
• The questions the health check uses to judge whether agent permissions are appropriate for purpose

👉 Nexis' full article details the Microsoft tenant health-check approach and the cross-identity access findings it surfaces

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.