CIAM in 2026: agentic AI, passkeys and sovereignty gaps

At a glance

What this is: This is Ory’s view of five CIAM trends for 2026, led by agentic AI risk, passkey usability, mobile UX, modular architecture, and sovereignty pressure.

Why it matters: It matters because CIAM teams now have to govern human, non-human, and emerging autonomous identity behaviour in one operating model without assuming human-scale controls still fit.

By the numbers:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read Ory's full analysis of CIAM trends in 2026

Context

CIAM is now carrying more than human login flows. As agentic AI, passkeys, mobile sessions, and sovereignty constraints converge, the old assumption that identity is mainly about a person authenticating once and then operating in a stable session no longer holds. In 2026, the primary question is whether your CIAM programme can still prove who or what acted, on whose behalf, and under which policy boundary.

The article frames that shift through five trends, but the deeper issue is governance. Identity teams now need to decide how non-human actors are authenticated, how consent and accountability are attached to their actions, and how machine-scale identity operations are audited without overwhelming the stack. That makes CIAM a control plane for human identity, non-human identity, and emerging autonomous behaviour at once.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do agentic AI systems challenge existing CIAM controls?

A: Because they can create, sequence, and execute identity events at machine speed, often outside the assumptions built into human login, session, and review processes. Traditional CIAM expects a person to authenticate, act, and stop. Agentic behaviour can stretch those steps across tools and systems without a human-paced control loop.

Q: How can organisations improve passkey adoption without creating recovery chaos?

A: Design recovery first. Validate device migration, account restoration, and fallback behaviour before broad rollout, especially for users with old email addresses or multiple devices. Passkeys reduce phishing risk, but only if the surrounding lifecycle paths let legitimate users regain access cleanly when state changes.

Q: What does data sovereignty mean for modern CIAM programmes?

A: It means identity data, authentication events, and related processing must respect residency, access, and deletion constraints across jurisdictions. For globally deployed CIAM, sovereignty is no longer just about uptime or regional hosting. It is a design constraint that affects architecture, support access, and lifecycle management.

Technical breakdown

Agentic AI identity needs a different trust model

Agentic AI changes CIAM because the actor no longer just authenticates and waits for a request. It can decide which tools to call, when to act, and which downstream systems to reach, which means identity, authorisation, consent, and audit all have to survive runtime behaviour that is not fully predictable at provisioning time. Protocol debates around MCP, OAuth extensions, OIDC, SPIFFE, and PKI matter, but the control problem is broader: the system must still answer what action was taken, why it was taken, and who initiated it.

Practical implication: Treat agent identity as a runtime governance problem, not a static login problem, and design for tool-use traceability from the start.

Passkeys solve phishing resistance, not lifecycle friction

Passkeys replace passwords with cryptographic credentials that can sync across devices, which removes a lot of recovery pain. But the article shows that user experience still depends on device migration, browser behaviour, backup eligibility, and recovery paths when an account is tied to old email addresses or broken device state. The real challenge is lifecycle continuity: authentication may be stronger, but the surrounding onboarding, recovery, and step-up flows still determine whether users can actually get back in.

Practical implication: Validate recovery, device change, and fallback journeys before expanding passkey coverage across higher-risk user populations.

Mobile authentication fails when app and browser state diverge

The embedded-browser problem is a CIAM design issue, not just a front-end annoyance. Native apps, system browsers, and webviews do not always share the same credential store, session state, or passkey availability, so a user can move from a trusted mobile app into a broken authentication loop without any control failure in the IdP itself. That makes session lifetime, reauthentication triggers, and platform-specific browser boundaries part of the identity architecture.

Practical implication: Map mobile session behaviour end to end so your authentication design matches the device and browser boundaries users actually encounter.

NHI Mgmt Group analysis

Agentic AI makes CIAM a non-human identity control plane, not an extension of human login. Once an AI agent can independently act on behalf of a user, the real governance question becomes what identity evidence is attached to the agent and what audit trail proves consent. The article correctly points to OAuth 2.1, OIDC, SPIFFE, ReBAC, and PKI as building blocks, but the field should read this as a sign that CIAM is absorbing NHI governance requirements. Practitioners should stop treating agent access as a future edge case.

Runtime identity for AI agents will matter more than protocol choice. The market is still debating MCP, A2A, and OAuth extensions, yet the underlying control requirement is stable: every agent needs an identity, authorisation must be bound to that identity, and the action trail must be attributable. That means the architecture can change, but the governance outcome cannot. The immediate lesson is to design for accountability before standardisation catches up.

Machine-scale identity operations are the real CIAM shockwave: an organisation with 100,000 humans can still face millions of agent-driven identity events. That volume breaks the human-scale assumptions embedded in authentication, authorisation, and audit pipelines. The implication is not just more load, but a different operating model for detection, logging, and policy enforcement across NHI and human identities alike.

Passkey success depends on recovery governance, not cryptography alone. The article shows that the technical credential is only one part of the control surface. If users cannot recover accounts cleanly across devices, email histories, and platform-specific states, the programme creates support burden and abandonment even when phishing resistance improves. Practitioners should treat recovery and fallback design as first-class identity controls, not afterthoughts.

Data sovereignty is becoming an identity routing problem as much as a privacy problem. Where identity data lives, who can access it, and how deletion is enforced now affect CIAM architecture directly, especially when agentic AI may process regulated data across borders. That pressure aligns CIAM with broader identity lifecycle governance, because residency, access, and offboarding have to be enforceable across cloud, hybrid, and potentially self-hosted deployment models.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to the 2026 Infrastructure Identity Survey.
• Another finding from OWASP NHI Top 10 is that agentic systems introduce identity and tool-use risks that do not map cleanly to human-centric IAM.
• For a deeper policy lens, Ultimate Guide to NHIs , 2025 Outlook and Predictions shows how machine identities are expanding faster than governance models.

What this signals

Agentic AI will force CIAM teams to separate authentication from accountability. Once an agent can initiate actions at runtime, a successful login no longer proves that the right party approved the downstream behaviour. That pushes programmes toward stronger identity binding, better consent artefacts, and audit trails that can survive machine-speed execution across tools and services.

Machine-scale identity will expose hidden assumptions in current telemetry stacks. If authentication, authorisation, and audit pipelines were built around human session rates, they will struggle when identity events multiply across services and agents. Teams should use this trend to pressure-test logging volume, retention, and evidence quality before agent adoption expands further.

With 80% of organisations already reporting AI agents performing actions beyond intended scope, the gap is no longer theoretical, and the governance response needs to include OWASP Agentic AI Top 10 style controls rather than generic automation policy.

For practitioners

• Map agent identity and consent chains Document where AI agents obtain identity, how user consent is recorded, and which downstream tools they are allowed to reach. Include logging for action initiation, not just authentication success, so the audit trail can show who or what initiated each step.
• Test passkey recovery under real device churn Run device replacement and account recovery scenarios for users with old email addresses, cloud sync disabled, and mixed platform states. Verify that fallback paths do not force password resets or support escalation as the default recovery mechanism.
• Redesign mobile sessions around browser boundaries Inventory where embedded browsers, system browsers, and native app sessions diverge. Rework session lifetime, step-up triggers, and authentication handoffs so users do not get trapped in broken state transitions when moving between mobile surfaces.
• Build for machine-scale audit and logging Validate whether authentication, authorisation, and audit pipelines can absorb millions of identity events from agents and services without losing traceability. If they cannot, the CIAM architecture is still assuming human-scale behaviour.
• Define sovereignty rules for identity data and agent processing Specify where identity data may reside, who may access it, and how deletion requests will be enforced across regions and systems. Extend those rules to any AI agent that processes personal or regulated data on behalf of the organisation.

Key takeaways

• CIAM in 2026 is no longer just about human authentication, because agents and mobile workflows now stress the identity stack in new ways.
• The biggest risk is not that the controls disappear, but that they still assume human-scale behaviour while machine-scale identity events keep growing.
• Programmes that align recovery, auditability, sovereignty, and agent governance will have a better chance of surviving the next CIAM reset.

Key terms

• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Data Sovereignty: Data sovereignty is the principle that information remains subject to the control, governance, and legal expectations of the organisation or jurisdiction that owns it. In identity programmes, it becomes a control question about who can authorise, revoke, and evidence access as systems cross borders.
• Machine-Scale Identity: Identity activity generated at volumes and speeds typical of services, workloads, and AI agents rather than human users. It changes how teams size authentication, logging, and authorisation systems because event rates can outgrow designs built around human sessions.

What's in the full article

Ory's full blog covers the operational detail this post intentionally leaves for the source:

• Examples of how CIAM teams are thinking about agentic AI standards, protocols, and consent handling in deployment.
• Practical UX discussion of passkey recovery, device replacement, and fallback design across consumer-facing journeys.
• More detail on mobile session behaviour, embedded browser failure modes, and why some native-app patterns break authentication.
• Additional context on modular identity architecture, sovereignty requirements, and scale assumptions behind machine-driven identity events.

👉 Ory's full blog covers agentic AI, passkeys, mobile UX, and sovereignty implications in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.