AI agents are outpacing identity governance in the enterprise

At a glance

What this is: C1.ai reports that autonomous AI agents are now embedded in enterprise operations faster than governance can keep up, with 95% adoption for IT or security tasks and major visibility gaps across non-human identities.

Why it matters: IAM and IGA teams need to treat agent access as a live authorisation problem, because delegated machine work creates governance gaps that human approval cycles cannot see in time.

By the numbers:

• 95% of organizations report AI agents performing IT or security tasks autonomously.
• 80% of organizations experienced at least one identity-related breach in the past year.
• Only 22% say they have full visibility into those identities.

👉 Read C1.ai’s report on AI agents, identity risk, and the agentic enterprise

Context

AI agents are now operating inside enterprise systems as delegated identities, not just as experimental copilots. The identity governance question is no longer whether teams can review access periodically, but whether they can control what an agent can reach while it is acting.

This matters because approval workflows built for people assume access is stable long enough to be reviewed. Autonomous agents compress that timeline, so entitlement scope, tool reach, and auditability have to be enforced at runtime rather than after the fact.

C1.ai’s report frames this as the rise of the agentic enterprise, where human, non-human, and AI identities increasingly share the same operational environment. The report says many organisations are already there, which makes the governance gap a present operating issue rather than a future concern.

Key questions

Q: What breaks when AI agents are reviewed like human users?

A: Human review assumes access is stable long enough to be observed, approved, and recertified. Agentic workflows often complete within one session and can change scope mid-execution, so the review cycle arrives too late to matter. The result is a governance gap where the action has already happened before anyone can certify it.

Q: Why do unknown AI agents create a higher identity risk than approved ones?

A: Unknown agents bypass the normal lifecycle steps that make access governable, including approval, recertification, and offboarding. They may still hold production-level access, which means the security team is managing execution without governance evidence. The risk is not just misuse, but the inability to show who owns the identity or why it exists.

Q: What are the signs that non-human identity governance is starting to slip?

A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments. The article mentions caveats, dispatch limits, SSO support, and automated update channels, all of which point to the need for controlled operational discipline. When teams cannot explain how identities are provisioned, updated, and constrained, governance is already weaker than it should be.

Q: How should security teams model AI agents in cloud governance when the agent runs through a service account?

A: Treat the agent as an identity surface, but treat the service account as the source of effective privilege. The agent itself usually acts through delegated access, so governance should trace the full chain from invoker to agent to service account to downstream resources. That approach exposes blast radius, shared credentials, and over-privileged paths before they turn into control gaps.

Technical breakdown

Why autonomous agents break periodic access review

Periodic access review assumes an identity holds privileges for long enough that a reviewer can observe, assess, and recertify them. Autonomous AI agents change that assumption because they can request, use, and release access within a single operational cycle. That makes review-based governance a lagging control for a real-time execution model. The practical issue is not just who approved the agent, but whether the approval model can describe the tools, data, and actions the agent may assemble dynamically during work.

Practical implication: move governance decisions closer to issuance and execution time instead of relying on recertification alone.

How delegated access expands the non-human identity surface

The report links AI agents with service accounts, API keys, and automation workflows as part of one expanding identity surface. That matters because each delegated identity can carry its own lifecycle, privilege scope, and audit trail, yet organisations often govern them with different tools or no single inventory. When identities are multiplied across systems, the failure mode is fragmentation: no one system can prove who or what is acting, under whose authority, and with which entitlement set.

Practical implication: consolidate inventory, ownership, and entitlement visibility across machine and agent identities before trying to enforce policy.

What runtime governance must control for AI agents

Runtime governance for AI agents is about constraining action, not just authenticating presence. The report points to the need to control which tools an agent can reach, what operations it can perform, and whose authority it is acting under. That is a different problem from human IAM because the agent’s behaviour can vary by task, context, and delegated scope. Once the agent can chain tools or call systems autonomously, static role assignment alone cannot express the real risk boundary.

Practical implication: define per-task authorisation boundaries and observable decision points for agent activity, not only static roles.

Threat narrative

Attacker objective: The objective is to turn delegated AI access into an uncontrolled execution path that expands privilege, weakens auditability, and increases the blast radius of compromise or misuse.

1. Entry begins when an AI agent receives delegated access to enterprise systems through identity and access tooling rather than through a traditional human login.
2. Escalation occurs when that delegated access is broad enough to let the agent reach multiple tools, data sources, or workflows without fresh human review.
3. Impact follows when autonomous execution outpaces governance, creating identity-related breaches, excessive privilege exposure, and audit gaps across the enterprise.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Autonomous identity governance is collapsing the assumption that access persists long enough to be reviewed. Human-paced certification cycles were built for stable entitlements and predictable operators. Autonomous agents can obtain and use privileges inside a short execution window, so the control now fails at the timing layer as much as at the permission layer. Practitioners need to treat issuance-time control as the governing boundary.

Agentic identity turns non-human identity sprawl into a governance problem, not just an inventory problem. Service accounts, API keys, automation workflows, and AI agents are converging into one operational identity surface. When organisations split ownership across IAM, cloud, and application teams, no single control plane can explain who acts, what authority they have, or when that authority expires. The implication is unified governance across machine and agent identities, not separate policy silos.

Identity blast radius becomes the decisive metric once agents can chain tools autonomously. The article shows that enterprises are not just adding more identities, they are adding identities that can act faster than human oversight. That means privilege scope, delegation depth, and tool reach matter more than the mere presence of an approved account. Security leaders should re-evaluate how far an agent can travel inside the environment before detection or intervention can occur.

Agent-speed operations expose a control gap between authentication and authorisation. A system may know an agent is authenticated, but still fail to govern what that agent can do next across multiple tools and data paths. That gap is where modern identity incidents accumulate because identity proof and action control are no longer the same event. Practitioners should separate recognition of the actor from constraint of the actor's runtime behaviour.

Unified governance is now the baseline expectation for modern identity programmes. The report’s mix of adoption, breach experience, and visibility shortfall shows that human-only governance is no longer structurally adequate. The field is moving toward a model where human, non-human, and AI identities are managed as one security domain with different operating rules. Teams that do not adapt will keep certifying yesterday’s access while agents act in today’s environment.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Agentic identity governance is moving from a theoretical future state to an immediate control requirement. When 53% of security leaders expect AI to run major portions of infrastructure autonomously within three years, the governance model has to move from periodic review to runtime constraint according to the 2026 Infrastructure Identity Survey. Teams should assume delegated machine work will be normal, not exceptional, and design access boundaries accordingly.

Identity blast radius will matter more than simple identity counts. The article’s core warning is that human, non-human, and AI identities are converging into one operational surface, which means the next maturity step is not just inventory but control of how far an actor can move once it is inside the environment. Governance programmes that still separate review, entitlement, and execution controls will keep missing the point.

Runtime authorisation becomes the named control problem for AI agents. Access reviews can still matter, but they no longer carry the whole burden when the actor can take and release access inside one task. That shifts programme design toward task-scoped entitlements, explicit delegation boundaries, and telemetry that shows what the agent actually did.

For practitioners

• Define agent-specific authorisation boundaries Map each AI agent to the exact tools, data sources, and operations it may use, then remove everything outside that task scope from standing access.
• Create a unified identity inventory Inventory service accounts, API keys, automation workflows, and AI agents in one control view so ownership and access scope can be traced end to end.
• Shift reviews toward runtime controls Use issuance-time policy, task-scoped access, and telemetry on agent actions so governance does not depend on periodic recertification alone.
• Separate human approval from machine execution Require explicit control points for delegated machine actions so an agent cannot extend its own reach simply because a human approved the initial request.

Key takeaways

• AI agents are now embedded in enterprise operations at a scale that makes identity governance a live operational issue rather than a future planning exercise.
• The biggest gap is not just visibility into non-human identities but the inability of periodic review models to keep pace with autonomous execution.
• Security teams should redesign governance around runtime boundaries, delegated authority, and unified oversight across human, non-human, and AI identities.

Key terms

• Agentic enterprise: An operating model where humans and autonomous AI systems work together inside the same business workflows. The security challenge is that decisions, data movement, and access all happen at machine speed, so governance must track both the actor and the workflow context.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Non-Human Identity Visibility: Non-human identity visibility is the ability to identify, classify, and monitor machine identities across systems, pipelines, and cloud services. It is the baseline for governance because teams cannot secure what they cannot enumerate, and hidden identities usually carry the highest privilege risk.

What's in the full report

C1.ai's full report covers the operational detail this post intentionally leaves for the source:

• Survey methodology for 508 IT and security leaders at U.S. organisations with more than 1,000 employees
• Breakdown of agentic enterprise adoption across production, pilot, and early workflow stages
• The full set of identity-related breach vectors, including phishing, social engineering, malware, and ransomware
• Organisational responses to NHI risk, including IAM spending and governance priorities

👉 The full C1.ai report covers adoption, breach patterns, and visibility gaps across non-human identities

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.