AI identities expose the inventory gap in modern IAM governance

At a glance

What this is: This live Identiverse discussion argues that AI identity governance starts with inventory, then moves to delegation, visibility, and usage-based access control.

Why it matters: It matters because IAM, IGA, PAM, and NHI teams are already being asked to govern AI agents with controls that still assume human-paced review cycles and long-lived access.

👉 Read Hitachi ID's live Identiverse discussion on AI identities, inventory, and delegation

Context

AI identity governance begins with a simple question: what identities exist, what can they access, and who can revoke that access when the task is complete. The discussion from Identiverse argues that most organisations are still missing that inventory foundation, which is why access reviews keep appearing as the default governance response. For teams running IAM, IGA, PAM, and NHI programmes, the problem is less about branding the identity as AI and more about whether the access model is visible enough to govern.

The conversation also treats delegation as the right identity model for AI agents, not impersonation. That distinction matters because delegated, task-scoped access can be traced and revoked, while borrowed human credentials blur accountability and make usage-based governance harder to enforce. For a deeper NHI baseline on inventory, lifecycle, and access control assumptions, see the [Ultimate Guide to NHIs](https://nhimg.org/the-ultimate-guide-to-non-human-identities).

Key questions

Q: How should security teams govern AI-assisted work that inherits human credentials?

A: Treat it as a delegated identity path, not a simple user session. Security teams should map the human, service account, and agent involved, then monitor the sequence of actions, the tools used, and the systems reached. That lets teams detect when authorised activity drifts into a higher-risk behavioural pattern before containment becomes impossible.

Q: Why do access reviews often fail to improve identity governance?

A: Access reviews fail when teams treat completion as success. If reviewers only confirm that an entitlement exists, rather than whether it should exist, the programme becomes a reporting exercise. Effective reviews remove unnecessary access, surface role drift, and trigger follow-up on exceptions that no longer match business need.

Q: What breaks when an AI agent is not part of identity inventory?

A: When an AI agent is not part of identity inventory, governance breaks at the point of discovery. Teams cannot reliably answer who owns the agent, what credentials it uses, or what systems it can reach. That makes access review, offboarding, and incident response incomplete because the trusted entity was never formally brought under control.

Q: When should organisations prefer revocation over blanket certification?

A: Organisations should prefer revocation when access can be removed safely and restored quickly without breaking operations. That approach exposes whether the control model is truly usage-based, while blanket certification usually hides unclear ownership and slow entitlement cleanup.

Technical breakdown

Why inventory is the first control for AI identities

Inventory is the control that turns an unknown AI estate into a governable one. In identity terms, inventory means being able to enumerate each agent, service account, token, and workload identity, then map it to an owner, purpose, and access scope. Without that baseline, every downstream control becomes reactive because teams cannot tell whether an identity is legitimate, stale, or over-privileged. This is the same failure pattern IAM has seen with service accounts for years, only now the growth rate is faster and the runtime behaviour is less predictable.

Practical implication: build a current inventory of AI-linked identities before expanding certification, PAM, or lifecycle workflows.

Delegation is different from impersonation

Delegation gives an agent bounded authority to perform a task, while impersonation makes the agent operate as if it were a human principal. That difference matters because impersonation collapses accountability, expands blast radius, and makes traceability dependent on the wrong identity. A delegated model can pair task-scoped permissions with logging that shows what the agent did, when, and under whose authority. That is much closer to workload identity discipline than to traditional user authentication.

Practical implication: design agent access as delegated workload identity, not as a shadow human account.

Access reviews signal maturity gaps, not governance success

Frequent blanket access reviews usually indicate that the programme does not yet have reliable usage telemetry or policy-based controls. If entitlements are being recertified because the system cannot explain who really needs them, then the governance model is compensating for weak design. The more mature pattern is to remove access quickly and make re-grant friction low enough that operational teams do not fear revocation. That shifts governance from periodic approval to continuous control backed by traceable usage.

Practical implication: measure how many entitlements can be revoked and re-granted safely, not how many review campaigns were completed.

NHI Mgmt Group analysis

AI identities are exposing an inventory problem, not a naming problem. The field keeps talking about agentic risk as if the label itself changes the control model, but the real issue is whether the organisation can enumerate what exists and what it can touch. Inventory is the precondition for governance across NHI, human, and autonomous workflows. Without it, access reviews, recertification, and least-privilege decisions are all built on partial information.

Delegation is the right governing pattern for AI agents because impersonation destroys the accountability chain. When an agent acts under a delegated workload identity, the permission boundary stays visible and task-scoped. When it borrows a human identity, every audit question becomes harder to answer and every revocation becomes more disruptive. The practitioner conclusion is that identity architecture must preserve the actor distinction instead of collapsing it.

Blanket access reviews are a maturity signal, not a control destination. A programme that still depends on periodic certification is revealing that it lacks policy-driven, usage-based entitlement control. The discipline should move toward immediate revocation with low-friction regrant, because that changes both user behaviour and governance quality. The implication is that access review volume should be treated as evidence of design weakness, not operational excellence.

The market is moving toward task-scoped identity for machines and agents, but most programmes are not ready to govern that shift consistently. AI systems will increasingly rely on ephemeral credentials, delegated permissions, and telemetry-rich runtime controls, yet many IAM models still assume long-lived access and human-speed approval cycles. That mismatch will push identity teams to align NHI, PAM, and IGA more tightly. Practitioners should expect their current governance stack to be tested first on AI agents and then on the rest of the machine estate.

Identity governance will increasingly be judged by how well it handles revocation without operational disruption. The room’s point about ripping and replacing vendors applies more broadly: mature programmes tolerate change, because dependency on a brittle access model is a governance risk. That means the next phase of identity work is less about adding more review layers and more about building confidence in rapid removal and reissue. The practitioner takeaway is to optimise for controlled reversibility, not for static ownership comfort.

From our research:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which shows why inventory-first governance is still the baseline problem.
• That visibility gap becomes more acute as AI agents expand the non-human estate, so teams should also review Top 10 NHI Issues for the next control set.

What this signals

AI identity programmes will fail fastest where inventory and lifecycle governance remain split. The practical risk is not that teams lack policy language, but that they cannot answer which identities are active, who owns them, or how quickly they can be removed. That is why the next phase of identity work will look less like a new AI security layer and more like the tightening of existing NHI, PAM, and IGA controls around visibility and revocation.

Task-scoped delegation will become the default expectation for machine and agent access. As AI systems take on more operational work, human-style account sharing will look increasingly brittle because it obscures accountability and slows response. Practitioners should expect pressure to prove that permissions can be issued, traced, and revoked at machine speed without relying on manual review cycles.

For practitioners

• Create a live inventory of AI-linked identities Enumerate agents, service accounts, tokens, certificates, and workload identities in one governed register with owner, purpose, and access scope. Reconcile that inventory continuously against logs, infrastructure, and application deployment records so unknown identities do not accumulate outside lifecycle control.
• Model agent access as delegated workload identity Assign task-scoped permissions to agents and avoid borrowing human credentials for machine execution. Keep the delegation chain explicit so audit logs can show which identity acted, which tool was used, and when access should expire.
• Treat access reviews as a fallback control Use reviews where telemetry is incomplete, but track how many entitlements can be removed first and restored later without business interruption. If regrant is too hard, the review process is hiding a design flaw rather than fixing access risk.
• Align PAM, IGA, and NHI controls around revocation speed Measure how quickly high-risk access can be revoked across human, machine, and AI identities, then test whether reissue can happen without manual escalation. That gives you a practical view of whether the governance model can survive real operational change.

Key takeaways

• AI identity risk is really an inventory and accountability problem, not a terminology problem.
• Delegated, task-scoped access gives practitioners a clearer model than impersonation for agent governance.
• Programmes that still depend on blanket access reviews are signalling maturity gaps, not governance strength.

Key terms

• Delegated workload identity: A delegated workload identity is a machine or agent identity that receives permission to perform a specific task without inheriting a human principal's credentials. The important governance point is that authority stays bounded, traceable, and removable at the task level instead of being shared through impersonation.
• Usage-aware governance: A governance model that uses actual activity as part of access decisions. Instead of certifying access only by role or schedule, it checks whether the entitlement is still being used, still justified, and still appropriate for the current context.
• Identity Inventory: Identity inventory is the process of discovering and recording every identity that can access systems or data. For NHIs, it includes owner, purpose, privilege scope, lifecycle status, and where the credential is used. Without inventory, governance, audit evidence, and incident response all become partial and unreliable.
• Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.

What's in the full article

Hitachi ID's full podcast episode covers the operational detail this post intentionally leaves for the source:

• The full Identiverse conversation on how senior IAM practitioners are thinking about AI identity inventory and access visibility.
• The live discussion of access review fatigue, revocation design, and why usage-based governance is replacing blanket certification.
• The delegation versus impersonation framing for AI agents, including how task-scoped permissions change the audit model.
• The unanswered audience questions that did not fit into the live session but matter for implementation planning.

👉 Hitachi ID's full episode includes the room debate, unanswered questions, and the delegation model for AI agents.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.