Identity security maturity in the AI era demands new controls

At a glance

What this is: This is an identity security maturity analysis arguing that the control plane has shifted from networks to identity, with AI agents and non-human identities exposing gaps in legacy IAM and IGA.

Why it matters: It matters because IAM, PAM, IGA, and security architecture teams now have to govern human, machine, and agent identities through the same lifecycle and control model without assuming human-paced behaviour.

By the numbers:

• Compromised credentials and access misuse remain involved in 80% of enterprise breaches.
• Non-Human Identities now outnumber human employees by an average of 80 to 1.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope.

👉 Read Oleria Security's identity security maturity analysis for the AI era

Context

Identity has become the primary security control plane because access decisions now determine how users, workloads, APIs, and AI systems reach data and applications. That shift exposes a problem for organisations that still treat identity as an administrative function rather than a core security boundary, especially when machine identities and AI agents inherit broad access.

The article argues that legacy IAM and IGA were built around human assumptions such as predictable schedules, role stability, and periodic review cycles. Those assumptions do not hold when AI agents chain actions in real time, inherit delegated authority, and create forensic ambiguity about whether a human, an automated routine, or a malicious prompt drove the behaviour.

Key questions

Q: What fails when AI agents inherit broad access through delegated identity paths?

A: The failure is the assumption that delegated access stays understandable and reviewable after assignment. AI agents can chain actions across systems, reuse inherited authority, and expand blast radius without a clean offboarding moment. That means ownership, intent, and revocation no longer align cleanly with the identity that actually executed the action.

Q: Why do legacy access reviews create blind spots for AI agents and NHIs?

A: Because they assume access persists long enough to be observed at a review point. In agentic and machine workflows, authority can be created, exercised, and discarded between review cycles, leaving little evidence for quarterly governance. Continuous telemetry and lifecycle controls are needed to close that gap.

Q: How should security teams prioritise identity work when NHIs outnumber humans at scale?

A: Start with identities that can reach sensitive systems, inherit privilege, or create lateral movement potential. Inventory is only the first step. Prioritisation should focus on blast radius, revocation difficulty, and how much trust a given identity can accumulate across cloud, SaaS, and AI workflows.

Q: What is the difference between JIT access and static RBAC for agentic systems?

A: Static RBAC assigns enduring permissions to a role, while JIT access grants time-bound authority for a specific task. For agentic systems, that difference matters because task scope can shift during execution, and long-lived role grants can outlast the work they were meant to support.

Technical breakdown

Why static RBAC breaks for AI agent identity

Role-based access control works when a subject’s duties are stable enough to map to a pre-defined entitlement set. AI agents do not behave that way. They can chain actions across systems, change paths based on context, and inherit permissions from users or services that were never designed for machine-paced decision loops. That creates overreach even when the original role assignment looked reasonable. In practice, static RBAC becomes a poor fit for dynamic workload and agent behaviour because it cannot express temporary intent, runtime context, or bounded delegation cleanly.

Practical implication: move high-risk agent access away from static roles and into context-aware, time-bound authorisation.

How delegated authority expands NHI blast radius

Delegated access is common in machine and agentic systems, but delegation without lifecycle discipline creates hidden persistence. An AI agent may receive access through a user, developer account, service account, or API token, then reuse that authority across cloud services, SaaS tools, and databases. If the delegation chain is broad or long-lived, the blast radius extends well beyond the original task. The technical risk is not just access volume but inheritance depth, because each hop in the chain can obscure ownership, revocation, and accountability.

Practical implication: inventory delegation paths and remove any inherited privilege that cannot be tied to a current business task.

Why identity telemetry matters for autonomous workflows

When identity activity becomes machine-generated and agent-driven, traditional review cadences are too slow to explain what happened. Continuous telemetry is needed to see which identity initiated the action, which tools were called, and whether the sequence stayed within expected scope. This is where identity threat detection and analytics complements SIEM and XDR, because the problem is not only an event but the identity context behind it. Without that context, investigations cannot reliably separate routine automation from malicious or unintended execution.

Practical implication: correlate identity telemetry with SIEM and XDR so agent actions can be investigated in real time.

Threat narrative

Attacker objective: The attacker aims to turn delegated identity into a durable execution path that supports lateral movement, privilege misuse, and broader compromise.

1. Entry begins when attackers gain access through compromised credentials, exposed NHIs, or delegated identity paths that were never tightly scoped.
2. Escalation follows when the identity inherits broad privileges across cloud, SaaS, or database environments and can chain actions beyond its intended task.
3. Impact occurs when attackers use that hidden execution path to move laterally, misuse access, and expand the blast radius across connected systems.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance assumptions built for human work patterns collapse when agents execute in machine time. Quarterly review cycles assume access remains stable long enough to be observed, certified, and removed. AI agents can inherit, chain, and discard authority within a single operational flow, so the governance model no longer matches the behaviour it is supposed to control. The implication is not simply more review, but a different premise for how access exists at runtime.

Standing privilege is becoming the wrong mental model for agentic access. The article’s own framing shows why long-lived access is too coarse for systems that operate across cloud, SaaS, and data platforms with delegated authority. Once those privileges are inherited by an agent, the distinction between original assignment and downstream use weakens quickly. Practitioners should read this as a sign that entitlement ownership and execution ownership are diverging.

Blast radius, not just identity count, is the governance variable that now matters. The 80 to 1 NHI ratio is important, but the more decisive issue is how many identities can act with inherited privilege and no clear revocation boundary. That is why mature identity programmes must connect discovery, lifecycle control, and access enforcement across human, machine, and AI systems. The practitioner conclusion is to govern by reachable impact, not by identity inventory alone.

Continuous identity oversight is now a control-plane requirement, not a monitoring luxury. The report’s maturity model is directionally correct in treating discovery, JIT access, ITDR, and human-on-the-loop guardrails as a progression toward maturity. The real shift is that identity assurance must move from periodic governance to runtime governance when agentic systems are in play. Security teams should treat this as a design constraint for identity architecture, not an add-on capability.

From our research:

• AI agents have already performed actions beyond their intended scope in 80% of organisations, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a compliance and investigation blind spot.
• That same research also shows 98% of companies plan to deploy even more AI agents within the next 12 months, which raises the governance bar rather than lowering it.

What this signals

Identity governance must now be designed for systems that do not wait for human review. As agentic workloads spread, the control question is no longer whether access exists, but whether it can be bounded, observed, and revoked before the next automated action. Teams should expect identity architecture to move closer to runtime policy enforcement and away from periodic certification.

Blast radius will become the primary executive metric for NHI and AI agent risk. Organisations that already struggle to track machine identities need a single way to compare exposure across service accounts, tokens, and agent permissions. The practical benchmark is how much connected infrastructure an identity can reach if trust is misplaced.

Programme owners should align identity telemetry with lifecycle governance now. Discovery without revocation leaves hidden execution paths in place, while revocation without telemetry leaves incidents unexplained. The next phase of maturity is not just more inventory, but tighter linkage between classification, access scope, and live behaviour.

For practitioners

• Audit delegated access paths Inventory every workload, service account, API token, vendor identity, and AI integration that can inherit permissions across cloud and SaaS systems.
• Replace standing privilege with JIT access Use ephemeral, task-scoped access for high-risk administrator and autonomous service account activity so excess privilege does not persist between tasks.
• Build a human-on-the-loop escalation rule Require explicit human approval for privilege escalation and sensitive data actions even when routine agent tasks execute autonomously.
• Connect identity telemetry to detection tooling Feed identity activity into SIEM and XDR so investigations can distinguish routine automation from anomalous or malicious agent behaviour.

Key takeaways

• Identity has moved from a back-office control to the main perimeter for cloud, SaaS, and AI-driven operations.
• Static RBAC and quarterly review cycles are too slow for delegated machine and agent behaviour that changes in real time.
• The most effective response is tighter discovery, shorter privilege duration, and continuous identity telemetry across human and non-human estates.

Key terms

• Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.
• Human-on-the-loop: A control model where AI handles routine decisions while a human supervises exceptions and high-risk cases. In identity governance, it reduces manual effort without removing accountability, but only when escalation criteria, evidence capture, and approval boundaries are clearly defined and consistently enforced.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.

What's in the full report

Oleria Security's full report covers the operational detail this post intentionally leaves for the source:

• The full 12-domain maturity model grid for benchmarking identity security maturity across teams and environments.
• The BRiCE prioritisation methodology for comparing identity investments by business value, risk impact, cost, and effectiveness.
• Stage-by-stage guidance for moving from fragmented identity stores to continuous discovery and autonomous guardrails.
• The report's strategic roadmap for high-risk controls such as JIT access, ITDR, and AI guardrails.

👉 The full Oleria Security report covers the maturity model, BRiCE scoring, and strategic action plan in detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.