TL;DR: C1.ai says identity governance is shifting to continuous, automated, policy-driven operations, with organisations governing about 21,000 identities on average, 98% of access requests automated, and 90% of review tasks completed in under five days. Periodic human-led governance cannot keep pace once software becomes the primary execution layer.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on C1.ai's blog post: Identity governance is moving from periodic human review to continuous, policy-driven automation as software and non-human identities take on more execution work.
Why it matters: IAM, IGA, PAM, and NHI teams need to reassess whether their governance model is built for request cycles and review campaigns or for always-on access decisions at machine speed.
By the numbers:
- The median organisation automated about 98% of access requests.
- The median organisation completed 90% of access review tasks in under five days.
👉 Read C1.ai's analysis of identity governance at AI speed
Context
Identity governance is the set of controls that decide who or what gets access, who reviews it, and how exceptions are handled. In this article, the core governance gap is timing: the old model assumes access can be managed in batches, but modern environments change continuously across SaaS, cloud, infrastructure, service accounts, and AI-driven workflows.
The article’s central claim is that automation is no longer just supporting governance. It is becoming the operating model. That matters for NHI, agentic AI, and human IAM alike because the control plane now has to keep up with software-led execution, not just human request patterns.
Key questions
Q: How should security teams govern access when automation handles most requests?
A: Security teams should treat automation as the default execution path and build policy around exception handling, risk thresholds, and enforcement hooks. Human review should focus on sensitive access, ambiguous cases, and control failures that policy cannot resolve. The key is to design governance for decision volume, not reviewer availability.
Q: Why do periodic access reviews become less effective as environments become more automated?
A: Periodic reviews assume access stays stable long enough to be observed and certified. In automated environments, access changes continuously, so the review often captures a stale snapshot rather than the current state. That makes the control useful for oversight, but weak as the primary enforcement mechanism.
Q: What are the signs that an identity governance programme is too slow for current enterprise needs?
A: A programme is too slow when deployments require heavy professional services, integrations need extensive customization, and operational overhead stays high after go live. Another warning sign is reliance on periodic access reviews to manage dynamic access. If teams cannot adapt quickly across SaaS, cloud, and hybrid systems, the governance model is lagging reality.
Q: Should organisations prioritise automation or access certification first?
A: Automation should come first for routine lifecycle changes because certification cannot correct access that should never have been granted or removed late. Reviews still matter, but they work best as a validation layer after provisioning logic has been tightened. The stronger programme sequence is automated issuance and removal, then periodic certification.
Technical breakdown
Why periodic access reviews break at machine speed
Traditional governance cycles assume access persists long enough to be requested, reviewed, certified, and revoked in a predictable window. In modern environments, access changes daily and automation can act without waiting for tickets or approvals. That makes quarterly reviews and campaign-based certification too slow to reflect the state of the environment. The technical shift is from episodic certification to continuous policy enforcement, where governance logic has to sit closer to issuance and change events than to retrospective review cycles.
Practical implication: move high-frequency access decisions into policy and event-driven controls instead of relying on review campaigns to catch drift.
How non-human identities change governance volume and scope
Non-human identities expand the governance surface because they are numerous, persistent, and often embedded across services, cloud, and infrastructure. The article notes that service accounts are common and that AI-native environments can have a large share of identities that are not human. That changes the operational problem from user administration to lifecycle governance at scale. Identity governance now has to handle inventory, ownership, exceptions, and policy enforcement for identities that do not behave like employees and do not fit manual review rhythms.
Practical implication: treat NHI inventory and ownership as a governance dependency, not an inventory exercise left to infrastructure teams.
Why governance becomes the control plane
When automation handles routine access decisions, identity governance stops being a compliance afterthought and becomes the control plane for work itself. The control plane is the policy layer that determines what is allowed, under what conditions, and with what oversight. In this model, humans focus on policy design, exception handling, and audit confidence, while systems execute the routine path. That only works if policies are explicit, integrations are broad, and enforcement is consistent across applications, cloud, and infrastructure.
Practical implication: design governance as an operational control layer that can enforce policy continuously across the environments where work actually happens.
Breaches seen in the wild
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance has crossed from periodic administration into runtime control. The article describes a model where automation handles the routine path and humans supervise the exceptions. That is no longer a process optimisation; it is a change in where authority sits. For identity teams, the practitioner conclusion is that governance architecture now has to be treated as part of the live control plane, not as a monthly or quarterly checkpoint.
Non-human identity scale is what breaks the old governance cadence. Service accounts, workload access, and automated execution create volumes and change rates that manual certification cannot absorb. The practical issue is not whether review still exists, but whether review is being used for the right class of decisions. Practitioners should stop assuming human-centric cycles can meaningfully govern machine-led access patterns.
Continuous enforcement is becoming the baseline assumption for modern identity programmes. The article shows that organisations are already automating the overwhelming majority of routine requests and review work. That signals a structural shift: policy, provisioning, and exception handling now matter more than queue management. The implication for IAM, IGA, PAM, and NHI programmes is to align operating models with continuous change rather than episodic governance windows.
Governance maturity will increasingly be measured by how much judgment it reserves for exceptions. As routine decisions move into automation, human work should narrow to policy refinement, high-risk approvals, and audit confidence. That changes how practitioners think about scale, staffing, and control ownership. The conclusion is straightforward: if humans are still the bottleneck for routine access, the governance model is lagging the environment.
Access review cycles were built for access that stays visible long enough to certify. That assumption fits human-centric environments with slower change, but it fails when software becomes the primary execution layer and access decisions happen continuously. The implication is not simply to add more reviews; it is to rethink which decisions are reviewable after the fact and which must be governed at issuance time.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Continuous governance is becoming the operating expectation. Programs that still depend on periodic campaigns will struggle to keep pace with software-driven access changes across SaaS, cloud, and infrastructure. The practical shift is toward event-driven enforcement, exception handling, and tighter linkage between policy and provisioning.
Identity governance now has to cover the non-human majority in some environments. As service accounts, workload identities, and automation paths expand, the governance model has to track purpose, ownership, and scope with the same discipline applied to human access. The reader implication is clear: if NHI inventories are incomplete, governance is incomplete.
Governance at AI speed is really a control-plane problem. The question is no longer whether access review exists, but whether the programme can enforce policy before the business process stalls. Teams should prepare for a model where human effort is concentrated on exceptions, audit confidence, and high-risk approvals.
For practitioners
- Define policy boundaries for routine access Separate low-risk, high-volume access decisions from exceptions so automation can handle the routine path while humans focus on higher-risk cases.
- Inventory non-human identities as governed assets Create and maintain ownership, purpose, and scope records for service accounts, automation identities, and AI-driven execution paths.
- Shift certification toward exception-based review Reserve manual review for high-risk changes, privileged access, and unusual patterns instead of trying to certify every routine entitlement equally.
- Measure whether governance is still in the critical path Track how often access changes wait on humans, how many decisions are fully automated, and where approval queues slow production work.
Key takeaways
- Identity governance is shifting from scheduled review cycles to continuous policy enforcement because software now drives most routine access activity.
- The operational scale described in the article shows why human-led certification alone cannot keep up with modern identity change rates.
- Practitioners should move routine decisions into automation and reserve manual oversight for exceptions, privileged access, and audit-sensitive changes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on governance for large populations of machine and automation identities at scale. |
| NHI-01 — Improper Offboarding | Continuous governance depends on timely lifecycle handling when identities or automations are no longer needed. | |
| Recommendation — Apply NHI-05 to restrict routine automation identities to narrowly scoped, policy-bound access. Use NHI-01 to revoke automation identities and service accounts that no longer have a valid owner or purpose. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is fundamentally about how permissions and authorizations are managed continuously. |
| Recommendation — Align entitlement governance to PR.AA-05 so access decisions remain current as systems change. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article discusses scale, ownership, and lifecycle management of large identity populations. |
| Recommendation — Apply CIS-5 to maintain account inventory, ownership, and removal of stale identities. | ||
Key terms
- Continuous Identity Governance: An operating model where access decisions, lifecycle changes, and risk signals are handled as an ongoing process rather than a periodic campaign. It uses authoritative events, telemetry, and policy automation to keep access aligned with current business and security conditions.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Access Review Campaign: An access review campaign is a scheduled process where application owners, managers, or delegates confirm whether existing permissions should remain in place. It is a control for removing excess access, but it only works when reviewers can understand the permissions and complete decisions reliably.
- Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- Cross-customer metrics showing how many access requests, reviews, and integrations organisations are handling in practice
- Breakdowns of governance behaviour by organisation size and industry, useful for benchmarking your own operating model
- Narrative examples of how automation changes the day-to-day work of identity teams
- The article's framing of what “normal” looks like when governance is embedded instead of episodic
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 7, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org