Curity board change signals growing pressure on identity control planes

At a glance

What this is: Curity frames agentic AI adoption as a shift that makes identity infrastructure a control plane for both human and non-human identities.

Why it matters: This matters because IAM teams will be judged on whether they can govern human access, NHI scale, and autonomous system behaviour through one identity model.

Context

Agentic AI is forcing identity programmes to move from point controls to control-plane thinking. In practical terms, that means the identity layer has to govern who or what can act, when it can act, and under which policy boundaries across both humans and NHIs.

Curity's board change is the trigger, not the subject. The real issue is that identity governance is no longer only about authentication or directory hygiene; it is about operating a common control plane for human users, machine identities, and autonomous systems as their scale and behaviour converge.

That convergence changes the unit of governance. Teams are no longer only managing accounts and sessions, they are managing delegated authority, runtime access, and lifecycle control across multiple actor types at once.

Key questions

Q: How should security teams govern machine identity credentials in agentic AI environments?

A: Security teams should extend secrets scanning to cover MCP configuration files, enforce short-lived credentials for all agent workloads, and assign clear ownership to every non-human identity regardless of its origin , human-created or AI-generated.

Q: Why do autonomous SOC tools change identity governance requirements?

A: Autonomous SOC tools change identity governance because they make decisions at runtime rather than following a fixed script. That means access, escalation, and evidence handling are no longer purely procedural. They become governed behaviours that need clear ownership, traceability, and rollback paths, especially when the system can suppress work before a human sees it.

Q: What breaks when NHIs are managed outside identity governance?

A: Ownership becomes unclear, offboarding is missed, and reviews stop reflecting actual operational access. That leaves service accounts and automation identities in place long after the workflow, system, or vendor relationship that justified them has changed.

Q: Should organisations prioritise identity governance before expanding agentic AI?

A: Yes. Organisations should establish ownership, least privilege, monitoring, and revocation for machine identities before broadening agentic AI use. Without those controls, each new agent can multiply blast radius and create shadow access that is hard to unwind after an incident.

Technical breakdown

Why identity becomes a control plane in agentic AI environments

A control plane is the policy and decision layer that governs how identities are created, authenticated, authorised, and retired. In agentic AI environments, that layer matters because autonomous systems may initiate actions, select tools, and consume access in ways that are not captured by traditional user-centric IAM flows. The result is not simply more identity objects, but more runtime decisions that depend on identity state, policy evaluation, and lifecycle visibility. For NHIs, this already applies to service accounts and tokens; for agentic systems, the same pattern extends to delegated execution and time-bounded authority.

Practical implication: Map agent behaviour to the identity control plane before expanding autonomous workflows.

How human and non-human identity governance starts to converge

Human IAM and NHI governance have historically used different assumptions. Human access is managed around authentication events, user journeys, and periodic reviews, while NHIs are governed through secrets, workload identity, and lifecycle controls. Agentic AI pulls those lines together because the system can behave like neither a pure person nor a static machine account. That creates a governance layer where provisioning, authorization, and revocation need to be understood across actor types instead of in separate silos. The important shift is operational: the same control plane has to express policy for staff, service identities, and autonomous actors without collapsing them into one indistinct model.

Practical implication: Design governance rules that distinguish actor type while sharing one policy architecture.

What board-level change says about identity operating models

Board attention is often an indicator that a category is moving from technical concern to operating-model concern. When identity becomes the control plane for autonomous systems, the question is no longer only whether a product can authenticate an actor. The question becomes whether the organisation can run identity as a business-critical platform with accountability, resilience, and scale. That affects ownership between IAM, platform engineering, security architecture, and governance functions. It also means identity leaders should expect stronger scrutiny of control coverage, integration depth, and the ability to support both human and machine access under one governance model.

Practical implication: Elevate identity from a tooling discussion to an operating-model decision.

NHI Mgmt Group analysis

Identity control plane is the right lens for agentic AI governance: agentic systems create a new class of runtime decision-making that cannot be governed as if they were static workloads or ordinary users. The control plane has to account for who initiated action, what policy allowed it, and whether that authority was reusable, ephemeral, or delegated. That makes the identity layer the centre of operational control, not a peripheral dependency. Practitioners should treat this as a governance architecture shift, not a feature request.

Human IAM and NHI governance are converging into one operational discipline: the old split between user identity controls and machine identity controls breaks down when autonomous systems sit between them. Humans still need authentication, assurance, and access governance, while NHIs still need lifecycle, secrets, and privilege management. But agentic AI forces programmes to understand how those controls interact inside one execution chain. The implication is that identity teams need a shared control model with actor-specific enforcement, not separate policy islands.

Identity lifecycle becomes more important when actor behaviour is dynamic: static provisioning assumptions are a poor fit for systems that can request, use, and relinquish access at runtime. That is true for NHIs already, and even more true for autonomous systems that may change context mid-session. The governance challenge is not merely issuance, but the duration and scope of authority. Practitioner focus should move toward lifecycle control that can keep pace with runtime decisions.

Control-plane thinking will reshape identity architecture buying criteria: organisations will increasingly evaluate whether an identity platform can govern multiple actor types consistently across policy, telemetry, and assurance. That does not mean blending all identities together. It means proving that the architecture can preserve distinctions while still enforcing a single governance model. Practitioners should expect architecture reviews to focus on cross-domain coverage, not isolated point capabilities.

Monica Enand's appointment is a market signal about maturity, not a product signal: when board composition changes around identity infrastructure, it usually reflects a company preparing for scale, distribution, and category competition. For the field, that suggests identity control plane capabilities are becoming strategic rather than optional. The implication for buyers is to reassess whether their identity stack is designed for platform governance across humans, NHIs, and autonomous systems.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Agentic AI identity governance will increasingly be measured as an operating model problem: the key question is no longer whether an organisation can authenticate an actor, but whether it can govern runtime authority across humans, NHIs, and autonomous systems through one control plane. That shifts identity work from implementation detail to enterprise architecture.

Policy boundaries matter more than actor labels: teams that treat every non-human actor the same will struggle to preserve accountability as autonomous behaviour expands. The better model is actor-specific enforcement under shared governance, with lifecycle and authorisation rules reflecting how the actor actually behaves.

According to the 2026 Infrastructure Identity Survey, 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years. That expectation makes control-plane governance a near-term requirement, not a future architecture debate.

For practitioners

• Define the identity control plane Map the policy, authentication, authorisation, and lifecycle functions that must govern humans, NHIs, and autonomous systems together.
• Separate actor types in governance design Document which controls apply to human users, which apply to service accounts and tokens, and which must adapt for autonomous behaviour.
• Review delegated authority paths Identify where runtime access is granted through chained delegation so policy does not assume a single stable actor behind the action.
• Reassess board-level identity ownership Assign clear accountability for identity architecture as a business-critical control plane rather than a collection of disconnected IAM tools.

Key takeaways

• Agentic AI is pushing identity teams toward a control-plane model that spans human access, NHIs, and autonomous systems.
• The governance challenge is not only authentication, but how authority is delegated, scoped, and revoked across actor types.
• Organisations should treat identity architecture as a core operating-model decision if they expect autonomous systems to reach production scale.

Key terms

• Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Actor Type: Actor type is the governance classification of the identity subject, such as human, non-human, or autonomous. The distinction matters because different actor types create different trust assumptions, lifecycle requirements, and access risks, even when they use similar credentials or access the same systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.