TL;DR: Identity governance is under pressure from executive blind spots, non-human identities, and agentic AI, with the State of Identity Governance 2026 calling out the resulting execution gap, according to Omada Identity. The central issue is not awareness but governance models that still assume access, accountability, and review cycles move at human pace.
At a glance
What this is: This Omada Identity article argues that IGA is failing as AI and NHI sprawl outpace governance models built for human-paced access, accountability and review.
Why it matters: For IAM, IGA and PAM teams, the issue is that governance controls lose meaning when identities multiply faster than certification, offboarding and ownership processes can keep up.
By the numbers:
- nearly 30% of IGA programs fail, according to Omada Identity's EMA research.
Context
Identity governance is the set of processes that decide who or what should have access, who approves it, and when that access is reviewed or removed. In this article, the pressure point is not theory but execution, as AI and NHI sprawl make those processes harder to sustain at enterprise scale.
Omada Identity frames the current problem as an execution gap rather than a policy gap. Executive blind spots, non-human identities and agentic AI are changing the pace and shape of identity risk faster than many programs can absorb, which means the governance model itself becomes the constraint.
The article's core message is that access, accountability and certification cycles were built around human pace and stable ownership. That assumption is increasingly atypical in environments where machine identities and AI-driven behaviour expand continuously.
Key questions
A: The main failure is that certification and lifecycle controls assume a stable identity with a human-style ownership model. NHIs and AI agents can be created, delegated, and retired on operational timelines that make periodic review too slow to serve as the primary control. Governance has to shift toward ownership, issuance, and revocation state.
Q: Why does NHI and agent sprawl create more risk than extra headcount can fix?
A: Because the problem is not only scale, but ownership and lifecycle drift. More identities mean more exceptions, more stale entitlements and more gaps between who created access and who is responsible for removing it. Without tighter lifecycle control, governance work expands faster than teams can absorb.
Q: How do security teams know if IGA is actually keeping up with identity change?
A: Look at whether ownership, review status and retirement dates are current for every identity type, not just whether certifications were completed. If the programme cannot show timely removal of stale access or current accountability for machine identities, it is lagging behind actual identity movement.
Q: Should organisations treat non-human identities differently from human users in governance?
A: Yes. Non-human identities usually change faster, operate at higher volume, and are owned by systems rather than people. That means they need different review cadence, stronger lifecycle controls, and tighter evidence collection. A human-centric IAM process will miss much of the machine access risk.
Technical breakdown
Why human-paced governance fails under NHI and agentic AI sprawl
Identity governance systems assume that access can be approved, reviewed and recertified on a schedule that is slow enough for people to own. Non-human identities break that assumption because they are created for services, pipelines and workloads that scale faster than manual oversight, while agentic AI can introduce additional access dynamics during runtime. The result is not just more identities but a mismatch between the governance clock and the operational clock. When review cycles lag behind issuance cycles, governance becomes retrospective paperwork rather than active control.
Practical implication: treat issuance, ownership and removal as the control point for NHIs and agents, not periodic review alone.
What executive blind spots mean for identity risk
Executive blind spots in this context are not simple visibility failures. They are governance failures where leadership does not have a reliable picture of how many identities exist, who owns them, or how quickly they change. That matters because IGA depends on accurate scope, asset ownership and exception handling before recertification can be meaningful. When the inventory is incomplete, every downstream control is weakened, including access reviews, segregation of duties and offboarding. The governance problem is therefore structural, not just operational.
Practical implication: align identity inventory, ownership and exception handling before expecting certification to reduce risk.
Why lifecycle controls matter more as identities multiply
Lifecycle controls such as joiner-mover-leaver handling, access recertification and offboarding are the foundation of governance across human and non-human identities. In AI and NHI-heavy environments, those controls have to handle entities that may be short-lived, delegated, inherited or reassigned without a person directly managing each change. That changes the economics of governance: stale access becomes harder to spot, and ownership drift becomes more common. The control plane has to follow identity movement, not just record the result after the fact.
Practical implication: extend lifecycle governance to machine and agent identities with the same rigor applied to human access.
NHI Mgmt Group analysis
Identity governance is no longer failing at policy design, it is failing at execution design. The article points to a programmatic gap that appears when access reviews, ownership and offboarding are built for human-paced change but are applied to NHI and agentic AI sprawl. The practical conclusion is that governance quality now depends on how quickly identity state can be brought under control, not on how complete the policy library looks on paper.
Non-human identity sprawl creates governance debt that classic IGA metrics often hide. Counting applications, certifications or completed reviews does not tell you whether service accounts, tokens and agent identities are owned, current or removable. The article's framing is a warning that volume can rise faster than accountability, and that programs which equate activity with control will miss the real failure mode.
Agentic AI changes the assumption behind least-privilege governance. Traditional IGA treats access as something granted to a known actor for a defined task, then reviewed later. Once an autonomous or semi-autonomous system can change behaviour, tool use and access needs while running, the governance premise shifts from approval to runtime constraint, and that is a different operating model entirely.
Identity blast radius: the combined risk created when too many identities, owners and review events accumulate faster than governance can reduce them. This article shows that blast radius is the right lens for modern IGA because the issue is no longer isolated misconfiguration. It is the compounding effect of sprawl, weak ownership and review cycles that cannot keep pace with the environment.
IGA maturity now has to be judged by remediation velocity, not by process completion. If identities can be created, delegated or abandoned faster than the programme can remove them, the governance model is only documenting exposure. The implication for practitioners is that lifecycle enforcement, ownership clarity and exception closure are the real measures of control strength.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: IGA Buyer's Guide
What this signals
Identity governance is shifting from a policy discipline to a state-management discipline. Once machine identities and agentic AI scale beyond manual oversight, the question is no longer whether access reviews exist, but whether the programme can maintain a trustworthy view of who or what has access at any moment. That is where many IAM and IGA programmes will need to mature next.
Lifecycle governance is now the pressure test for enterprise identity maturity. If joiner-mover-leaver logic, recertification and offboarding do not extend cleanly to NHIs, the programme will keep accumulating identity debt even when audit artefacts look healthy. Practitioners should expect that gap to surface first in ownership, exception handling and stale access removal.
For practitioners
- Define ownership for every non-human and agent identity Map each service account, token, certificate and AI-driven identity to a named business or technical owner, with a clear removal path when that owner changes.
- Shorten review cycles for fast-changing identities Move from broad periodic recertification to review cadences that reflect how quickly NHIs and agent permissions change in production.
- Embed lifecycle checks into provisioning and offboarding Require joiner-mover-leaver style controls for machine and agent identities so access is validated at issuance and revoked when the identity's purpose ends.
- Track governance gaps as an operational backlog Measure how many identities remain without current ownership, review status or retirement date, and use that backlog as an indicator of IGA execution failure.
- Separate human review from runtime identity control For agentic systems, do not rely on downstream certification to contain access drift. Put runtime constraints around the actions the agent can take while it is active.
Key takeaways
- Identity governance is failing where its assumptions about stable ownership and slow-moving access no longer match AI and NHI-driven environments.
- The article cites EMA research showing nearly 30% of IGA programs fail, which underscores how execution gaps can outpace policy design.
- Practitioners need to treat lifecycle enforcement, ownership clarity and runtime constraint as the real controls, not certification activity alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centres on lifecycle failure as NHIs and agents outgrow review cycles. |
| NHI-05 — Overprivileged NHI | Governance failure often appears as access that outlives the identity's purpose. | |
| Recommendation — Extend offboarding controls to service accounts, tokens and agent identities before ownership drifts. Review NHI access scope against current task purpose and remove standing excess privilege. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governance of permissions and entitlement reviews across identity types. |
| Recommendation — Validate that entitlements, owners and authorizations stay current as identities change. | ||
| CIS Controls v8 | CIS-5 — Account Management | Lifecycle and removal of human and machine accounts are central to the execution gap described. |
| Recommendation — Inventory, review and deactivate identities that no longer have an active business purpose. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Account creation, review and disabling are the core governance mechanics under discussion. |
| Recommendation — Apply account management controls to ensure identities are provisioned, reviewed and removed on schedule. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Agentic AI Identity: The complete set of credentials, permissions, and governance controls applied to an autonomous AI agent, covering authentication, authorisation, action logging, and access revocation. Distinct from traditional NHI because agent identities are often ephemeral, delegated, and multi-hop.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org