Identity is shifting to trust, proof, and accountability

At a glance

What this is: This is a conference-based analysis of how identity security conversations are moving from implementation mechanics to trust, proof, and accountability.

Why it matters: It matters because IAM teams now have to govern humans, machine identities, and AI agents through the same accountability lens, not separate control silos.

👉 Read 1Kosmos' takeaways from Gartner SRM and Identiverse 2026

Context

Identity security is no longer being discussed only as an access problem. The more urgent question is how to establish trust, prove action, and assign accountability across human identities, service accounts, and AI agents that can act faster than review processes can observe.

That shift exposes a gap in many current IAM and NHI programmes: the controls were built to grant access, not to explain or prove runtime behaviour. As identity scope expands, lifecycle governance, delegated authorization, and auditability become as important as authentication.

The underlying challenge is not just more identities. It is that the enterprise now has to decide which identities are allowed to act, how long those rights should last, and what evidence exists after the fact. For machine identity governance, that is the hard part, not login itself.

Key questions

Q: How should security teams govern AI agents that act on behalf of people and systems?

A: Treat AI agents as governed identities, not just automation. Give each one a named owner, a bounded purpose, least-privilege access, short-lived credentials, and an auditable trail that ties intent to action. The key is to govern the delegation chain, not only the initial login or token issuance.

Q: Why do machine identities complicate identity governance programmes?

A: Machine identities complicate governance because they scale faster than human review processes and often inherit trust from shared secrets or embedded credentials. That weakens attribution, makes lifecycle management harder, and creates blind spots when access must be revoked, rotated, or proven after the fact.

Q: What breaks when identity programmes only measure authentication success?

A: Authentication success alone does not show whether the right identity acted, whether the action stayed in scope, or whether accountability survives a delegated workflow. Programmes that stop at login miss the operational question of what the identity did after it was trusted.

Q: Who is accountable when an AI agent or service account causes harm?

A: Accountability should rest with the human sponsor, system owner, and governance process that allowed the identity to act. If the organisation cannot identify an owner, a purpose, and a revocation path, the identity programme is not ready for delegated or autonomous action.

Technical breakdown

Identity trust at runtime

Traditional IAM assumes access can be judged at issuance, then reviewed later. Runtime trust changes that model by asking whether the identity is still behaving inside its intended context at the moment of action. For humans, that usually means session controls and step-up checks. For service accounts and AI agents, it means attribution, short-lived credentials, and policy that can follow the action rather than just the login. The article's core point is that the market is moving away from static permissioning toward evidence-based identity decisions.

Practical implication: treat runtime evidence as a control surface, not just logs for later investigation.

Machine identity governance

Service accounts, bots, integrations, and AI agents are not ordinary users with different names. They need their own identity lifecycle, ownership, and scope boundaries. When these identities inherit trust from a human or from a shared secret, the organisation loses attribution and cannot tell who or what actually acted. The article points to a growing machine identity gap because the old IAM model was built around people, while non-human identities now outnumber them in many environments.

Practical implication: assign explicit ownership, purpose, and lifecycle controls to every non-human identity.

Delegated authorization for AI agents

AI agents complicate identity governance because they can take actions, call tools, and hand off work without a human approving each step. That is different from ordinary automation. If an agent can select actions at runtime, identity control must account for the decision path, not only the credential it used. Standards such as SPIFFE help with workload identity, but the larger challenge is proving intent to action to outcome across a delegated chain. The governance problem becomes one of accountable delegation, not just access management.

Practical implication: map every agent action back to a sponsor, scope, and auditable authorization trail.

NHI Mgmt Group analysis

Identity governance is moving from entitlement management to accountability management. The article reflects a market shift in which knowing that an identity can authenticate is no longer enough. Practitioners now need to know which identity acted, under what authority, and with what proof. That changes IAM from a gatekeeping function into a runtime assurance discipline, and it raises the bar for both human and non-human identity programmes.

The machine identity gap is now a governance gap, not just a scale gap. Service accounts and AI agents are already forcing enterprises beyond people-centric IAM assumptions. The issue is not merely volume. It is that attribution, scope, and lifecycle controls break when identities are treated as background infrastructure instead of governed actors. That means machine identity must be managed as a first-class identity domain, not an engineering by-product.

Delegated action is the named concept practitioners should track. AI agents and other non-human actors increasingly operate through delegated action, where one identity can trigger work, pass tasks onward, and alter the chain of accountability. The control failure is not just weak access control. It is that the organisation cannot always prove who authorised the action or where responsibility ends. Practitioners should design for delegation chains, not single-step access events.

Runtime proof is becoming the dividing line between modern IAM and legacy control models. The article shows why point-in-time approval is not enough once identities can act continuously across tools and systems. Identity programmes that stop at issuance and review will miss the operational reality of machine and agent behaviour. The practical conclusion is that evidence, ownership, and time-bound authority now define mature governance.

Identity teams should expect human IAM, NHI governance, and agentic AI controls to converge. The next phase of the market is not separate tooling for each actor type, but a shared governance model that still preserves actor-specific controls. That convergence does not erase differences between people, service accounts, and autonomous systems. It forces practitioners to govern all three through one accountability framework with different enforcement layers.

From our research:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
• Identity teams that need the lifecycle angle should also review NHI Lifecycle Management Guide for provisioning, rotation, and offboarding patterns.

What this signals

Identity trust will increasingly be judged by proof, not policy statements. As agents and machine identities multiply, governance teams should expect more pressure to show who authorised an action and how that authority was constrained. The old model of periodic review will not be enough when runtime decisions happen faster than certification cycles.

Delegation chains are becoming the new audit perimeter. Once a request can flow from a human to a service account to an API call and then to an agentic workflow, the real control problem is tracing responsibility across actor types. Teams should prepare for audit models that capture context, not just entitlement snapshots, and align them with the NIST Cybersecurity Framework 2.0.

Runtime accountability is now an identity architecture requirement. Delegated action should become a design concept in programme planning because it captures the new failure mode: authorised access that no longer tells you who caused what. Organisations that build for ownership, scoped authority, and evidence will be better placed to govern human IAM, NHI, and AI agents together.

For practitioners

• Define accountable ownership for every non-human identity Assign a human sponsor, business purpose, and revocation path to each service account, token, certificate, or AI agent. Shared identity ownership is where attribution breaks down first, especially when runtime actions need to be traced back to a decision-maker.
• Shorten the lifetime of machine credentials Replace long-lived secrets with short-lived credentials and explicit renewal logic. If an identity can act only for a bounded period, you reduce the window in which inherited trust can be abused or forgotten.
• Build runtime evidence into access decisions Capture what the identity actually did, not only what policy said it could do. Correlate tool use, task execution, and downstream actions so review teams can see whether the identity stayed within its intended scope.
• Separate human approval from machine execution Do not assume that a human sign-off covers every downstream step taken by an AI agent or workload. Where delegation exists, define which actions require fresh authorization and which can proceed within pre-approved bounds.
• Map delegation chains end to end Trace how a request moves from a person to a service account, API, or agent, then to any sub-agent or external tool. Gaps usually appear where the chain crosses ownership boundaries or changes identity type without a new control point.

Key takeaways

• The article's central message is that identity security is moving from access administration to runtime accountability.
• The governance gap is widening because machine identities and AI agents now outnumber human-centric assumptions built into older IAM models.
• Practitioners should respond by tightening ownership, lifecycle control, and evidence capture across every delegated identity path.

Key terms

• Runtime trust: Runtime trust is the ability to decide whether an identity should keep acting at the moment it performs work, not only when it first authenticates. In identity governance, that means access decisions must reflect context, evidence, and current scope instead of relying solely on initial approval.
• Machine identity: Machine identity is the governed identity used by software, services, workloads, and AI agents to authenticate and act. It includes certificates, tokens, service accounts, API keys, and similar credentials, all of which need ownership, lifecycle control, and auditable boundaries just like human identities.
• Delegation chain: A delegation chain is the sequence of identities and systems through which authority moves from one actor to another. In modern IAM, that chain may start with a person and pass through service accounts, APIs, and agents, which makes accountability dependent on tracing each handoff clearly.
• Accountability: Accountability is the ability to prove which identity acted, under what authority, and for what purpose. For human, NHI, and agentic systems alike, accountability depends on ownership, logging, and policy that connects intent to action instead of stopping at access approval.

What's in the full article

1Kosmos' full post covers the operational detail this analysis intentionally leaves for the source:

• Conference-floor observations from Gartner SRM and Identiverse that explain how practitioners are reframing identity priorities.
• Direct commentary from 1Kosmos leaders on agent accountability, attribution, and proof in identity governance.
• The vendor's view on why SPIFFE, OAuth-based delegation, and short-lived credentials matter for machine identity.
• Event context and networking notes that show how the industry conversation is changing in practice.

👉 The full 1Kosmos post covers the conference themes, leadership commentary, and market signals in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.