TL;DR: Government agencies cannot treat SAML modernization, agentic AI access, and post-quantum cryptography as separate projects because legacy federation, machine-speed delegation, and cryptographic transition are colliding in the same access path, according to Ping Identity. The real problem is that human-era identity assumptions no longer match runtime agent behaviour or long-lived protocol dependencies, and the edge becomes the practical control point.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Ping Identity's blog post: Gateway-based identity control can front legacy SAML systems while introducing runtime policy for AI agents and preparing identity flows for PQC migration.
Why it matters: It matters because identity teams now have to govern browser federation, machine-speed delegation, and cryptographic transition as one access-path problem instead of three separate programmes.
Context
Government identity programmes are being pulled in three directions at once: long-lived SAML dependencies, AI agents that act at machine speed, and a cryptographic transition that reaches into certificates, signatures, and federation. The core governance gap is that these systems were designed for human users and classical trust assumptions, not for runtime decisions or post-quantum constraints.
A gateway changes the problem boundary by sitting in front of applications, APIs, and services as the first policy enforcement point. That does not eliminate legacy dependency, but it gives identity teams a place to mediate modern and legacy flows, centralise control, and sequence migration without forcing a risky big-bang cutover.
Key questions
Q: How should agencies handle SAML applications while moving toward modern identity controls?
A: Keep essential SAML applications running behind a controlled edge rather than attempting a big-bang replacement. The key is to move policy enforcement, visibility, and mediation to the gateway first, then migrate backend applications in waves based on risk, readiness, and mission impact.
Q: Why do autonomous agents require different access governance than human users?
A: Human IAM assumes a stable user session and a predictable review cycle. Autonomous agents can request, combine, and use permissions inside a short runtime window, so lifecycle, delegation, and revocation have to operate continuously. The risk is not just overpermission, but permission being used before any human review can occur.
Q: What breaks when post-quantum migration stops at the transport layer?
A: A quantum-resistant connection to the gateway does not make downstream SAML assertions, certificates, XML encryption, or application libraries post-quantum secure. The failure is partial migration, where the visible edge is upgraded but the transaction still depends on classical cryptography deeper inside.
Q: How should identity teams balance gateway control and application migration?
A: Treat the gateway as a migration boundary, not a substitute for application change. The right model is to stabilise the edge now, then retire legacy translation paths, certificates, and protocol dependencies as each application reaches its target state.
Technical breakdown
Why SAML becomes a migration constraint at the edge
SAML still works because it is deeply embedded in application integrations, certificates, metadata, and session behaviour. The technical problem is not that SAML is unusable, but that each application-level trust relationship hard-codes a separate dependency chain for signing, encryption, and federation. Once those dependencies are distributed across vendors, mission owners, and legacy applications, security changes become coordination problems as much as technical ones. A gateway gives teams a point to normalise access policy before the request reaches the backend, which is why edge control matters more than another round of application-by-application tweaks.
Practical implication: inventory the SAML trust chain at the edge before you attempt to modernise the backend.
How agentic AI changes identity and access decisions
Agentic AI breaks the human-speed assumption behind traditional sign-on because an agent can call tools, move across services, and trigger actions inside a single workflow. That means the meaningful security question is no longer only who logged in, but what the agent is allowed to do, on whose behalf, and against which resource right now. Broad standing access creates confused-deputy risk when the agent inherits a person's authority too freely. Runtime policy enforcement, explicit delegation, and short-lived credentials are needed because the access decision has to happen in the request path, not only at session start.
Practical implication: enforce action-scoped authorization for AI agents at the request path, not just at initial authentication.
What PQC really means for identity infrastructure
Post-quantum cryptography is not a TLS-only issue. In SAML environments, the transport layer, XML signatures, XML encryption, certificates, keys, libraries, and application dependencies can each rely on classical cryptography, so one upgraded connection does not make the full transaction quantum-resistant. That is why cryptographic inventory matters more than a single cipher-suite change. Agencies need to know where asymmetric cryptography is used, where classical algorithms remain embedded, and which trust relationships still depend on them before they can claim meaningful readiness.
Practical implication: map every cryptographic dependency in the SAML transaction before treating any part of it as PQC-ready.
NHI Mgmt Group analysis
Gateway control is becoming the practical identity boundary for mixed legacy and autonomous access. When SAML, AI agents, and PQC all converge on the same access path, the backend application is no longer the right place to absorb every change. The edge becomes the only realistic point where policy, translation, and visibility can be applied consistently. The practitioner conclusion is straightforward: identity architecture now has to be judged by what can be controlled before the resource is reached.
The human-session model of federation is no longer sufficient for machine-speed delegation. Traditional federation assumes a user logs in, receives a session, and performs a bounded set of actions. Agentic behaviour breaks that sequence because the actor can initiate multiple tool calls and service interactions without returning to a human checkpoint. The implication is not that federation is obsolete, but that access governance has to move from session trust to request-level evaluation.
Quantum readiness is an identity migration problem, not a cryptography side project. SAML environments depend on signatures, certificates, and backend trust relationships that are easy to underestimate when teams focus only on transport encryption. That is exactly why a gateway is useful as a staging boundary, but also why it is not the finish line. Practitioner conclusion: separate boundary protection from end-state PQC compliance and govern both explicitly.
Identity modernization will increasingly be measured by control placement, not protocol purity. The market signal here is that organisations will keep legacy federation alive longer than security teams would prefer, but they will demand stronger enforcement in front of it. That favours architectures that can mediate old and new identity patterns without waiting for every application owner to move in lockstep. The implication for practitioners is to plan for layered governance rather than a single protocol migration milestone.
From our research library:
- Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
- Read next: AI Agent Authorisation Guide
What this signals
Gateway-based identity control is becoming the interim operating model for mixed environments. Teams cannot wait for every SAML application to be rebuilt before they enforce stronger policy. The practical shift is to govern identity at the edge, where old federation, modern tokens, and agent requests can all be mediated before backend exposure.
Action-scoped authorization is the pressure point for agentic access. A login is too early to answer the question that matters: what can the agent do right now, for this resource, in this context? Programmes that keep treating agent identity like a human session will miss the point where misuse actually occurs.
For practitioners
- Inventory the full SAML trust chain Map identity providers, service providers, certificates, signing and encryption algorithms, metadata exchanges, and application dependencies before planning any modernisation wave.
- Place a policy enforcement point at the edge Front legacy and modern resources with a gateway so authentication, authorization, routing, logging, and traffic controls happen before backend exposure.
- Scope AI agent access to the request path Require the agent identity, initiating party, requested action, and target resource to be evaluated before an agent reaches protected APIs or tools.
- Document every classical cryptography dependency Track which connections, assertions, certificates, libraries, and downstream applications still rely on non-PQC mechanisms so migration owners can sequence remediation realistically.
- Migrate applications in controlled waves Use the gateway to hold the external boundary steady while backend systems move from legacy federation and classical cryptography toward modern protocols and PQC-capable components.
Key takeaways
- Government agencies are being pushed to govern SAML, AI agent access, and PQC migration as one access-path problem rather than three isolated projects.
- The edge is becoming the main control point because it can enforce policy before legacy applications, agent requests, and classical dependencies are exposed.
- Gateway mediation helps teams make progress now, but it does not remove the need to inventory and retire legacy trust and cryptographic dependencies.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF, NIST Zero Trust (SP 800-207) and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents inheriting or overusing authority in runtime flows. |
| Recommendation — Enforce request-time authorization to stop agent identity from expanding beyond its intended scope. | ||
| NIST AI RMF | MANAGE — AI risk management | Agentic access and governance decisions require ongoing operational controls and accountability. |
| Recommendation — Build runtime controls and oversight for agent actions into the AI risk management process. | ||
| NIST Zero Trust (SP 800-207) | Policy enforcement point — Policy enforcement point | The gateway functions as the control boundary where access decisions are enforced. |
| Recommendation — Place policy enforcement at the edge so requests are evaluated before backend exposure. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article stresses inventory and migration of certificates, keys, and authentication dependencies. |
| Recommendation — Track and govern credential and certificate lifecycles across SAML and PQC transition paths. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Agent misuse and federated trust abuse can enable broader access across connected services. |
| Recommendation — Map agent and federation abuse paths to credential access and lateral movement detections. | ||
Key terms
- Gateway-based identity control: A gateway-based identity control pattern places authentication, authorization, routing, and monitoring in front of applications and services. It gives security teams a stable enforcement point for legacy and modern identity flows without requiring every backend system to be rebuilt at once.
- Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
- Post-Quantum Migration: Post-quantum migration is the process of moving cryptographic systems away from algorithms expected to be vulnerable to quantum computing. It requires discovering where legacy cryptography exists, prioritizing high-risk dependencies, and sequencing replacements carefully. The goal is to preserve trust and service continuity during a long transition.
- Identity Mediation: Identity mediation is the process of using digital tools, platforms, or intermediaries to present, verify, or adapt identity in a specific context. In practice, it shapes how people are seen by institutions and can encourage disclosure, concealment, or selective presentation of personal details. The design of the system affects fairness and access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on September 16, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org