Identiverse 2026 shows identity governance is moving beyond people

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Linx Security's blog post: Identity governance is expanding beyond workforce users to include non-human identities, AI agents, and MCP-connected systems.

Why it matters: IAM, IGA, and PAM teams need a unified governance model because access is now changing across multiple identity types faster than periodic review cycles can reliably capture.

Context

Identity governance is the set of processes and controls that decide who or what can access systems, data, and tools, and when that access should be removed or limited. In this post, the central shift is that governance is no longer built only around human users. The article argues that non-human identities, AI agents, and MCP-connected systems now sit inside the same control problem.

The practical issue is not whether these new identity types exist. It is whether organisations can keep ownership, accountability, and policy enforcement aligned as access changes continuously across workforce and machine actors. The article frames that as a move from periodic governance to continuous governance, which is the right lens for identity programmes that now span humans and non-humans alike.

Key questions

Q: What breaks when governance relies only on quarterly access reviews?

A: Quarterly reviews miss the day-to-day drift that accumulates between certification cycles. By the time the review happens, the access graph may already have changed, so the programme validates yesterday’s state rather than today’s risk. That makes certification useful for assurance, but weak as a primary control.

Q: Why do AI agents make non-human identity governance harder?

A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials. That increases the number of access paths security teams must supervise. The result is a stronger need for task-scoped access, explicit ownership, and continuous monitoring of what the agent can reach.

Q: How should security teams govern MCP in enterprise environments?

A: Treat MCP as an identity and authorization problem first. Assign ownership for every agent and tool, enforce runtime policy checks on each invocation, and limit what context can flow between tools. The goal is to reduce the agent’s blast radius before it reaches downstream systems, not to rely on static perimeter controls after the fact.

Q: How do organisations unify IAM, IGA, and NHI governance without creating more silos?

A: Start with one entitlement inventory and one ownership model, then apply actor-specific controls on top of it. Humans, NHIs, and AI agents do not need the same lifecycle mechanics, but they do need the same accountability structure. The goal is shared governance logic, not identical treatment.

Technical breakdown

Why periodic access reviews fail for AI agents and NHIs

Traditional access reviews assume that privileges persist long enough to be observed, certified, and remediated on a schedule. That model fits human users reasonably well, but it becomes fragile when service accounts, API keys, machine identities, and AI agents can gain or change access outside the review window. Real-time policy enforcement matters because the control point shifts from after-the-fact certification to active governance of issuance, connection, and action. In environments with MCP-connected systems, the question is no longer only who approved access, but what the identity can do at runtime and whether that behaviour is still aligned with policy.

Practical implication: Treat access review as a backstop, not the primary control, for identities whose privileges change faster than certification cycles.

How MCP changes the identity governance problem

Model Context Protocol matters because it gives AI agents a standard way to connect to tools and enterprise systems. That changes the identity surface from a static access list to an action-capable integration layer, where the agent may retrieve data, invoke tools, and trigger downstream workflows. From an identity perspective, the key issue is not the protocol itself but the governance it demands around who or what is allowed to connect, which tools are exposed, and how those actions are authorised and monitored. Once an agent can act across systems, MCP becomes an access path that must be governed like any other privileged integration.

Practical implication: Inventory MCP-connected access paths and define policy boundaries around what an agent may retrieve, invoke, and change.

What continuous governance means for mixed identity estates

Continuous governance is not just faster reporting. It is a shift in control philosophy from periodic attestations to ongoing visibility, decision support, and remediation across human, non-human, and autonomous actors. That matters because identity sprawl now includes workforce users, service accounts, cloud roles, AI agents, and autonomous workflows that do not follow the same lifecycle or review cadence. A unified strategy reduces the risk of treating each category as a separate programme with different rules, different owners, and different blind spots. The governance model has to scale across identity types because the access paths are converging even when the actors are not.

Practical implication: Design governance around one control model that can adapt to different identity types instead of maintaining isolated processes for each one.

NHI Mgmt Group analysis

Identity governance is becoming a multi-actor discipline, not a workforce discipline. The article is right to frame non-human identities, AI agents, and MCP-connected systems as part of the same governance problem rather than separate edge cases. Once access paths are shared across humans and machines, the programme has to govern ownership, entitlement, and revocation consistently. The practitioner conclusion is clear: identity strategy now lives or dies on whether it can span every actor type.

Periodic certification is no longer the control plane for modern identity risk. Quarterly reviews were built for access that changes slowly enough to be sampled, but AI-driven and machine-driven access changes faster than that assumption allows. This is a governance timing problem as much as an access problem, and it is why continuous controls now matter more than point-in-time assurance. Practitioners should treat review cycles as evidence, not enforcement.

Model Context Protocol turns integration design into identity design. MCP is not just another technical interface when AI agents can use it to reach business systems and take action. It creates a governance surface where visibility, authorisation, and accountability must be explicit. That means identity teams cannot leave protocol-enabled access to platform teams alone. The practitioner implication is to govern the connection layer with the same discipline used for other privileged access paths.

Unified governance is the real market signal. The article captures a broader category shift: buyers do not want separate controls for workforce IAM, NHI management, and AI governance if the access risk is converging. That does not mean the controls are identical, but it does mean the operating model has to be shared. The implication for practitioners is to build one governance strategy with actor-specific policy branches, not three disconnected programmes.

Continuous identity governance is becoming the default expectation for mixed estates. The strongest reading of Identiverse 2026 is that identity programmes will increasingly be judged on runtime visibility and response, not on whether a certification happened on schedule. That changes the centre of gravity for IGA, PAM, and NHI governance alike. Practitioners should expect continuous controls to become the baseline measure of maturity.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Unified identity strategy is becoming the practical response to identity sprawl. The programme question is no longer whether to add another tool for each actor type, but whether the control model can follow access across humans, NHIs, and AI agents without fragmenting ownership. That is why continuous enforcement and clear accountability matter more than category-specific process layers.

Identity leaders should expect governance boundaries to move closer to the runtime layer. As AI agents and protocol-connected systems become normal access paths, policy decisions will need to happen at connection time and action time, not just during periodic reviews. The operational signal is simple: if your programme only reacts after certification, it is already behind the environment.

For practitioners

• Build one governance model across actor types Map human users, service accounts, API keys, machine identities, AI agents, and autonomous workflows into a single entitlement inventory so ownership and accountability are not split across separate programmes.
• Shift certification to runtime enforcement Keep access reviews for audit evidence, but move actual control to policy enforcement, connection monitoring, and automated revocation where access changes faster than review cadence.
• Define ownership for AI agents and MCP-connected access Assign a named business and technical owner for each agent or protocol-connected integration, including who approves access, who monitors behaviour, and who removes it when the use case ends.
• Inventory and classify non-human access paths Separate service accounts, cloud roles, tokens, and AI-driven connectors by privilege level and business function so you can identify which identities carry production or data access.
• Design continuous controls for access drift Use event-driven policy checks and remediation triggers for permission changes, new connections, and unexpected tool use instead of relying only on quarterly attestation cycles.

Key takeaways

• Identity governance is no longer a workforce-only discipline because non-human identities, AI agents, and protocol-connected systems now share the same access surface.
• The central risk is governance lag, where periodic reviews cannot keep pace with continuously changing access across mixed identity estates.
• Practitioners need one identity strategy with runtime enforcement, explicit ownership, and actor-specific policy branches to keep control aligned with real access paths.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Continuous governance: An identity governance model that checks and enforces policy as activity happens rather than on a schedule. It is designed to catch drift, misuse, and orphaned access while the identity is still active, which matters when risk unfolds in minutes instead of review cycles.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Identity Ownership: Identity ownership is the assignment of a responsible human for each identity's purpose, access, review, and retirement. For non-human identities, ownership must be explicit because the creator is not always the right person to approve ongoing access. Without ownership, review and revocation become inconsistent and slow.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.