TL;DR: AI-related attacks rose nearly 490% year over year, while enterprises now average 139+ AI-enabled SaaS applications and 23,021 SaaS apps outside centralized visibility, according to Grip Security’s 2026 SaaS + AI Security Report. The governance gap is shifting from model oversight to identity, OAuth, and access-path control, which makes unmanaged non-human identities the operational weak point.
At a glance
What this is: This report argues that AI governance failures in enterprise environments are increasingly identity and access failures, with risk concentrated in OAuth, delegated access, SaaS sprawl, and non-human identities.
Why it matters: It matters because IAM, PAM, and NHI teams are being asked to govern AI risk in systems they cannot fully inventory, making visibility and access-path control central to AI governance.
By the numbers:
- AI-related attacks increased approximately 490% year over year, according to Grip Security.
Context
AI governance is no longer limited to model oversight or policy drafting. In enterprise environments, the real governance gap appears where AI capabilities, SaaS integrations, delegated permissions, and non-human identities intersect, especially when security teams cannot see the full application estate.
The article frames a common failure mode in modern AI programmes: governance assumes central visibility, but SaaS and AI adoption is distributed across thousands of applications and access paths. That makes the identity layer the practical control plane for AI risk, not the model layer alone.
Key questions
Q: What breaks when identity mapping is treated as enough for AI governance?
A: What breaks is the assumption that knowing an agent’s owner means the organisation can trust the agent’s behaviour. Identity mapping gives attribution, not enforcement. Without runtime policy checks and explicit human approval for high-risk steps, the agent can act beyond intent while still appearing legitimate.
Q: Why do OAuth connections make AI governance harder to manage?
A: OAuth turns AI governance into a delegated access problem because applications inherit scoped permissions that can outlive the security intent behind them. If those grants are not continuously governed, AI-enabled SaaS apps can reach data and actions that were never meant to be exposed.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.
Q: Should organisations treat non-human identities differently from human users in governance?
A: Yes. Non-human identities usually change faster, operate at higher volume, and are owned by systems rather than people. That means they need different review cadence, stronger lifecycle controls, and tighter evidence collection. A human-centric IAM process will miss much of the machine access risk.
Technical breakdown
Why OAuth and delegated access become the AI control plane
OAuth is an authorisation mechanism that allows one application to act on behalf of a user or service without repeatedly asking for credentials. In AI-enabled SaaS environments, that convenience becomes a governance problem because delegated permissions can persist, expand, and chain across apps. The risk is not just access, but durable access that is hard to inventory once the original approval is forgotten. When AI tools, browser extensions, and connected SaaS services inherit trust through OAuth, the security boundary shifts from the model to the identity grant.
Practical implication: Treat delegated access reviews as a core AI governance control, not a back-office IAM hygiene task.
How SaaS sprawl turns AI governance into an inventory problem
AI adoption inside SaaS platforms creates a decentralised estate where capabilities appear inside collaboration tools, productivity suites, CRMs, and development services. Governance breaks when the organisation cannot answer which AI-enabled apps exist, what data they touch, and which integrations connect them. In practice, this is a visibility and lifecycle issue: applications are adopted outside formal review, permissions accumulate, and controls lag behind actual usage. That is why AI governance in the enterprise increasingly resembles discovery and entitlement management rather than model review.
Practical implication: Build continuous discovery for AI-enabled SaaS, then bind policy enforcement to the live inventory rather than annual reviews.
Why non-human identities are the missing layer in AI governance
Non-human identities include service accounts, automation credentials, APIs, machine identities, and integrated SaaS permissions that operate without a human sitting in the session. As AI becomes embedded in enterprise workflows, these identities often carry the privileges that make AI useful and risky at the same time. They can read mail, access files, modify content, and retain access beyond the original operator’s awareness. The governance gap is that human-centred review processes do not adequately cover identities that act at machine speed and may never pass through the same review lifecycle.
Practical implication: Extend identity governance to machine and delegated identities that control AI access paths, not just employee accounts.
Threat narrative
Attacker objective: The objective is to exploit trusted identity relationships inside SaaS and AI environments to reach data and workflows without needing direct system compromise.
- Entry begins when users or administrators grant AI-enabled SaaS tools broad OAuth permissions or connect them through trusted integrations.
- Credential and access abuse follows when delegated scopes persist, allowing applications or agents to read mail, access files, or modify content beyond intended use.
- Escalation occurs as those connections spread across SaaS sprawl, creating indirect access paths and unreviewed non-human identities that are difficult to govern.
- Impact is the exposure of regulated data, internal communications, and enterprise systems through access relationships that security teams failed to inventory in time.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI governance debt is really identity governance debt: enterprises are attempting to control distributed AI adoption with governance models built for centralised systems. That model fails when access is created through SaaS integrations, delegated scopes, and machine identities that operate outside normal review cycles. The governance gap is not abstract, it is structural, and it puts IAM, PAM, and NHI teams at the centre of AI risk management.
OAuth has become the primary trust broker for enterprise AI: the article correctly shifts attention away from model misuse and toward delegated permissions. When an AI tool can inherit access through an approved grant, the security question becomes who authorised the scope, how long it persists, and whether the organisation can revoke it cleanly. Practitioners should treat OAuth trust as a governance boundary that must be continuously monitored.
Shadow AI is also shadow identity: unmanaged AI usage is rarely just an application discovery issue. It is usually a hidden identity problem involving service accounts, API keys, browser extensions, and other non-human credentials that extend access without equivalent oversight. The practical conclusion is that AI governance cannot be separated from identity lifecycle management.
Visibility is the control that determines whether policy matters: the article’s numbers point to a gap between governance intent and operational reality. If thousands of SaaS applications and AI-enabled services sit outside central oversight, policy becomes advisory rather than enforceable. That makes discovery, entitlement mapping, and offboarding the real governance priorities.
Identity governance is now the first line of AI risk reduction: organisations that keep treating AI governance as a model-centric discipline will miss the access pathways where actual enterprise exposure accumulates. The field needs to move from model approval to relationship control, because the permissions graph is where AI risk now lives. Practitioners should re-centre governance on access, delegation, and lifecycle enforcement.
From our research library:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- Read next: Identity Security Programme Guide
What this signals
Identity governance is becoming the operating layer for AI control: as AI spreads through SaaS ecosystems, the limiting factor is not policy language but the organisation’s ability to inventory grants, integrations, and non-human identities. AI programmes that cannot track delegated access will keep inheriting blind spots, no matter how mature the model review process looks on paper.
AI governance debt is now access-path debt: the practical risk is not simply that teams adopt too many AI tools. It is that each tool introduces a new trust path through OAuth scopes, service accounts, browser extensions, and third-party integrations. Security leaders should expect governance pressure to shift from approving use cases to continuously governing permissions.
Non-human identity control is the differentiator: modern AI ecosystems are built on machine identities that move faster than human review cycles. Organisations that still certify access only at the user layer will miss the privilege chains that let AI systems reach regulated data and operational workflows.
For practitioners
- Map AI-enabled SaaS to live identity grants Inventory every AI-enabled SaaS application, then map the OAuth scopes, delegated permissions, and service accounts that allow it to act across enterprise data and workflows.
- Review and constrain risky OAuth permissions Prioritise mail, file, content-modification, and long-lived delegated access grants, because those are the permissions most likely to turn AI convenience into persistent exposure.
- Extend governance to non-human identities Include automation credentials, APIs, machine identities, and browser extensions in the same governance workflow used for human accounts, with ownership, review, and offboarding requirements.
- Build continuous discovery for shadow AI Use recurring discovery and entitlement reconciliation to detect AI tools adopted outside formal review, then remove orphaned integrations before they become durable trust paths.
- Tie access-path analysis to incident readiness Document which systems and datasets are reachable through each AI integration so response teams can cut off delegated access quickly when a grant is misused.
Key takeaways
- AI governance in enterprise environments is increasingly an identity and access problem rather than a model-risk problem.
- The main exposure sits in delegated permissions, SaaS sprawl, and non-human identities that can outlive the business need that created them.
- Security teams need continuous discovery and entitlement control if they want AI governance to be enforceable instead of aspirational.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | OAuth delegation and persistent grants make authentication and authorisation boundaries central to the article. |
| NHI-05 — Overprivileged NHI | The article centres on excessive access held by service accounts, integrations, and machine identities. | |
| NHI-07 — Long-Lived Secrets | Persistent access and retained approvals are a core theme in the governance gap described. | |
| Recommendation — Review AI-connected identities for insecure delegated authentication and revoke over-broad grants. Constrain non-human identities to least-necessary scopes and remove excess permissions from AI-connected accounts. Shorten credential and grant lifetimes so AI access expires when the business need ends. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes abuse of delegated access and movement across connected SaaS systems. |
| Recommendation — Map AI-integrated access paths to credential access and lateral movement tactics for detection and response. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core governance failure is uncontrolled permissions and entitlements across AI-enabled environments. |
| Recommendation — Apply PR.AA-05 to continuously govern AI-related entitlements and delegated authorisations. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about organisational governance for AI risk and accountability. |
| Recommendation — Establish AI governance ownership that includes identity, access, and delegated trust oversight. | ||
Key terms
- Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- OAuth Scope: An OAuth scope is a permission string that defines what an application can do on behalf of a user. In practice, scopes set the blast radius of delegated access, because the token carries the right to read, write, or administer resources until it is revoked or expires.
- SaaS Sprawl: SaaS sprawl is the uncontrolled spread of software-as-a-service applications across teams and business units. It creates fragmented ownership, duplicated functionality, and weak visibility into who can access what. For IAM and NHI teams, the main risk is not only cost but persistent entitlements that outlive business need.
Deepen your knowledge
NHI Mgmt Group’s NHI Foundation Level course covers NHI governance, machine identity security, and secrets management, including the controls that matter when AI systems depend on delegated access. It is designed for practitioners who need to connect identity governance to operational security.
Published by the NHIMG editorial team on August 15, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org