Identiverse 2026 shows why AI agent identity needs runtime control

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Delinea's blog post: At Identiverse 2026, AI agent security was settling around ownership, discovery, and runtime authorization as the controls that actually matter.

Why it matters: IAM and NHI teams need to shift from static access grants to action-time governance, because agents can outpace review cycles and make after-the-fact accountability too late.

By the numbers:

• In most cases, AI agents already outnumber people at almost 40 to 1.

Context

AI agent identity is the practice of governing how software agents are owned, discovered, authorised, and audited as they act across tools, APIs, and data. The article argues that the old model of granting access once and reviewing later does not fit agent behaviour.

At Identiverse 2026, the security conversation shifted from whether AI agents exist to how they are controlled at runtime. That matters because agent identity now sits between workforce IAM habits and NHI governance, where standing credentials and static approval models are increasingly exposed.

The starting position described here is not atypical: many organisations are already deploying AI agents before they have a reliable inventory, owner model, or authorisation boundary for them.

Key questions

Q: What fails when AI agents are given access before they are inventoried?

A: Governance fails because the organisation cannot assign ownership, classify scope, or review access for agents it has not discovered. Discovery is the prerequisite for every later control, including approval, auditing, and offboarding. Without an inventory, access decisions become partial and reactive rather than enforceable across the full agent estate.

Q: Why do runtime authorization controls matter for AI agents that inherit human entitlements?

A: Runtime authorization matters because an agent can combine inherited permissions in ways that static review does not anticipate. If the initiating human’s entitlements are not bound into each downstream decision, the agent may retrieve data, invoke tools, or expose output that exceeds the intended scope. That creates a real-time access control gap.

Q: What are the signs that agent ownership is too weak to govern?

A: Common signs include agents created outside central IT, unclear accountability when an employee leaves, and no one able to explain which systems an agent can reach. If ownership is vague, review and offboarding will be slow or impossible. That usually means the identity programme has not yet extended lifecycle governance to agents.

Q: Should organisations treat AI agents as NHI or as application automation?

A: They should treat them as governed non-human identities with application behaviour. That framing captures the need for identity, scope, lifecycle, and audit controls while still recognising that agents operate through APIs, tools, and workflows. Pure automation language hides the governance gap.

Technical breakdown

Why ownership is now part of AI agent identity

An AI agent without a named human owner becomes impossible to govern through ordinary lifecycle controls. Ownership is not just an administrative label here. It determines who approves the agent’s scope, who inherits accountability when the original builder leaves, and who can answer for misuse of the agent’s delegated authority. In practice, this is the identity link that keeps machine behaviour attached to human responsibility. Once agents are created outside central IT, ownership becomes the only stable control plane for review, offboarding, and escalation. Without that link, discovery and runtime controls still leave a governance gap because nobody can accept or remove responsibility.

Practical implication: tie every AI agent to a named owner and make that ownership part of joiner-mover-leaver governance.

Why discovery has to come before authorisation

Discovery is the inventory problem for AI agents. If teams cannot find an agent, they cannot classify it, scope it, or decide which systems it may touch. The article’s emphasis on shadow AI reflects a basic control reality: authorisation can only be meaningful when the subject of the decision is visible. That is especially important in environments where agents are created outside central IT or embedded into workflows by business teams. Discovery also creates the metadata needed for downstream controls, including ownership, data access scope, and auditability. Without discovery, runtime authorisation becomes selective enforcement applied to only the agents teams already knew about.

Practical implication: build agent discovery and registration before you expand access decisions or approval workflows.

How runtime authorization changes the control model

Runtime authorization moves the decision from provisioning time to action time. Instead of giving an agent a credential and hoping downstream systems constrain it, a gateway brokers each request and evaluates whether the specific action should proceed. That matters because agent behaviour is not fully knowable at setup time. The article’s core architectural point is that the credential should stay out of the agent’s hands, with the gateway enforcing least privilege on each call. This is a structural shift from static trust to per-action trust, and it is the control pattern that aligns with fast-changing tool use, model choice, and session context.

Practical implication: authorize each agent action at the point of use and keep target credentials brokered rather than exposed.

Threat narrative

Attacker objective: The attacker objective is to abuse an agent’s delegated access in a way that bypasses human oversight and hides what the agent touched.

1. Entry occurs when an AI agent is created or deployed with broad access before the organisation has a full inventory or owner model for it.
2. Credential access happens when the agent is allowed to touch target systems directly instead of passing through a gateway that brokers each action.
3. Escalation follows when the agent can combine tool access, APIs, and data connections beyond the intent of the original request.
4. Impact is the loss of reliable accountability and the possibility of unauthorized access to systems or data through an ungoverned agent session.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ownership is the missing governance primitive for AI agents: an agent that cannot be tied to a named person cannot be reviewed, offboarded, or held to account in lifecycle processes. That is not a documentation issue. It is a control failure that turns agent proliferation into governance debt, especially when business teams deploy agents faster than IAM can catalogue them. The practitioner conclusion is that ownership must be treated as a hard requirement, not a courtesy.

Discovery is now the prerequisite for any meaningful authorisation decision: you cannot govern what you cannot enumerate. Shadow AI turns the classic access review problem on its head because the organisation may not even know which agents exist, let alone which data or APIs they can reach. The implication is that inventory quality now determines whether runtime controls are comprehensive or merely selective.

Runtime authorization exposes the collapse of standing trust for agents: the assumption that access can be granted once and safely reused for the rest of a session is increasingly false for AI behaviour. Agents act through tool chains, and the control boundary has to sit at the moment of action rather than at provisioning time. The practitioner conclusion is that trust must be continuously mediated, not preloaded into credentials.

Ephemeral credential trust debt: this article shows why handing an agent a live secret creates a governance obligation that outlives the moment of use. If the credential can be reused, inspected, or exfiltrated by the agent, the organisation has already accepted more trust than the task required. The conclusion is that agent security is becoming an issuance-time problem, not a review-time problem.

AI agent governance now sits at the intersection of NHI and human IAM: the human owner, the machine identity, and the action boundary all have to line up for the control model to hold. That makes this a lifecycle problem as much as an access problem. Practitioners should expect identity governance programmes to absorb agent controls rather than treat them as a separate security island.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Authorisation Guide

What this signals

Runtime control is now the decisive boundary for AI agents: the practical question is no longer whether an agent has access, but whether every action is mediated at the moment it occurs. That shifts the programme from permission grants to enforced decision points, which is where most current IAM stacks are still weakest.

Ownership, discovery, and action-time authorization form a single governance chain: if any one of them is missing, the control model becomes incomplete. Organisations that already struggle with service-account inventory should expect the same problem to reappear with agents unless they extend identity lifecycle discipline across both NHI and AI workflows.

For practitioners

• Assign hard ownership for every agent Bind each AI agent to a named human accountable for approval, review, and offboarding so lifecycle governance has a responsible subject.
• Inventory agents before granting scope Create a discovery workflow that identifies agents, their creators, and the systems they can reach before any access decision is made.
• Broker access at runtime Place a gateway in front of tools and APIs so each agent request is authorised at the moment of action, not through a standing token.
• Keep live credentials out of the agent Use centralized credential control so the target-system secret never lands in the agent session, reducing reuse and exfiltration risk.

Key takeaways

• AI agent security is converging on ownership, discovery, and runtime authorization as the controls that matter most.
• The article reinforces that static trust models do not fit agents that act through tools, APIs, and session-level decisions.
• Practitioners need governance that connects human accountability to machine action at the moment access is used.

Key terms

• AI Agent Identity: The digital identity used by an autonomous AI agent to authenticate to external systems, APIs, and services. Managing AI agent identities is an emerging and rapidly evolving area of NHI security.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agent gateway: The local or remote control layer that authenticates, pairs, and orchestrates an AI agent’s actions across connected tools. In practice it becomes an identity concentrator, because one gateway session can govern messages, commands, and downstream systems with far broader reach than the user interface suggests.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.