TL;DR: C1.ai says NIST IR 8596, the Cyber AI Profile, treats AI security as a problem of inventories, ownership, permissions, and continuous risk review because AI systems are now embedded in business and security workflows. Identity governance becomes the control plane when AI systems start acting, not just advising.
At a glance
What this is: NIST’s Cyber AI Profile reframes AI security around identity, permissions, ownership, and continuous risk review rather than model oversight alone.
Why it matters: IAM, IGA, PAM, and security teams need to treat AI systems as governed identities because authorization, approval, and revocation now shape AI risk.
👉 Read C1.ai's analysis of NIST's Cyber AI Profile and identity-led AI security
Context
The security gap here is not simply that AI is more capable. It is that AI is being embedded into business processes, security tooling, and decision workflows faster than many identity programmes can define ownership, permissions, and accountability for those systems.
NIST IR 8596, the Cyber AI Profile, builds on CSF 2.0 and the AI RMF to describe secure AI adoption across three areas: securing AI systems, using AI to defend the enterprise, and resisting AI-enabled attacks. In all three, the recurring control question is who or what is allowed to act, under what conditions, and with what review cadence.
Key questions
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review. That means tightly scoping tools, data, and actions; logging every material step; and making revocation and containment available while the session is still active. Static policy alone does not control machine-paced execution.
Q: Why do periodic access reviews struggle in AI-heavy environments?
A: Because risk changes faster than the review cycle. AI-driven workflows, automation, and service accounts can gain, reuse, or accumulate access continuously, while periodic reviews only capture a moment in time. That creates a gap between what was approved and what is actually being used. Continuous monitoring closes that gap better than certification alone.
Q: What breaks when AI agents are given broad inherited permissions?
A: Broad inherited permissions break the assumption that access is tied to a narrow business need. The result is larger blast radius, weaker accountability, and faster propagation of mistakes or abuse across connected systems. A single compromised or misconfigured agent can then touch far more data and workflows than the original task required.
Q: What does Zero Trust mean for AI agent identity governance?
A: For AI agents, Zero Trust means every request is authenticated and authorised in context, with access granted only for the specific task and duration required. Long-lived trust, broad entitlements, and reusable tokens all undermine that model. Teams should use Zero Trust to reduce standing privilege and make agent access auditable and disposable.
Technical breakdown
Why AI security becomes an identity problem
AI systems expand the security surface beyond models into agents, APIs, datasets, and training pipelines. Once AI can initiate actions inside operational workflows, the security question shifts from whether the output is trustworthy to whether the acting entity is properly identified, authorised, and monitored. That is why inventories alone are not enough. The controlling issue is whether the organisation can bind each AI action to an accountable identity, limit its permissions, and revoke access when the system changes role or scope.
Practical implication: Map every AI system to an identity, an owner, and an explicit permission boundary before it is allowed into production.
Continuous authorisation matters more than periodic review
Traditional IAM assumes permissions can be reviewed on a schedule after they are granted. The Cyber AI Profile points to a different operating model: AI systems may make or trigger decisions quickly enough that access review arrives too late. Human-in-the-loop approvals, scoped service accounts, and visible decision logs become part of the control path, not optional paperwork. This is the same governance shift seen in other high-speed machine identity environments, only now the system itself may be selecting actions inside the workflow.
Practical implication: Shift from periodic recertification to event-driven approval and revocation for AI permissions that can affect production systems.
What changes when AI becomes an actor, not a tool
The most important distinction in the profile is between AI that assists and AI that acts. When AI only recommends, the control problem is advisory risk. When AI can take actions, the control problem becomes authorisation, delegation, and containment. That makes permissions, service accounts, and policy boundaries central to safe AI use. It also means security teams need to understand which AI capabilities can cross from suggestion into execution without a human gate.
Practical implication: Classify AI capabilities by action authority, then apply stricter controls wherever the system can execute without direct human approval.
NHI Mgmt Group analysis
AI security has become an identity governance problem before it becomes a model governance problem. The Cyber AI Profile repeatedly returns to ownership, permissions, and revocation because those are the controls that determine whether AI can act safely inside enterprise workflows. Security teams that treat AI as a standalone model risk missing the real control plane. The practitioner conclusion is simple: if identity is not defined for the system, AI security is not operational.
Continuous risk review is the right frame for AI because static access assumptions age too quickly. NIST’s guidance aligns with the reality that AI systems can be updated, connected, or repurposed faster than annual governance cycles can keep up. That makes permission scope and action authority changeable states, not one-time decisions. The implication for practitioners is that AI governance must move from periodic certification to continuous control validation.
Identity is the only governance layer that can span human operators, service accounts, and AI-driven actions. The Cyber AI Profile implicitly treats AI security as a cross-domain problem, but the practical answer is the same across the stack: know who owns the action, what is authorised, and when authority must end. That is why AI security, NHI governance, and IAM now intersect instead of living in separate programme silos. The practitioner conclusion is to govern AI as an identity-bearing actor, not a feature.
Clear boundaries on action authority matter more than visibility alone. Seeing an AI-generated decision is useful, but visibility without enforced permission boundaries still leaves production systems exposed. The profile’s emphasis on human-in-the-loop approvals and controlled actions shows that observation is not the control. Practitioners should treat approval gates as part of the runtime security design, not as an after-the-fact oversight mechanism.
Named concept: identity control plane for AI security. This is the governance shift where identity becomes the mechanism for authorising, constraining, and revoking AI actions across tools and workflows. It matters because AI systems can move faster than traditional review cycles, so the control has to sit at issuance and execution time. The practitioner conclusion is to design AI security around identity enforcement, not only policy documentation.
From our research library:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
What this signals
Identity control plane for AI security: AI governance will increasingly be judged by whether permissions, approvals, and revocation are enforced at the moment of action. That changes programme design from document-centric assurance to runtime control.
Security teams should expect AI governance to converge with NHI governance because the hardest problem is now the same in both cases: how to authorise, limit, and end machine-held authority before it becomes operational risk.
For practitioners
- Map AI systems to accountable identities Assign each model, agent, API integration, and automation path an owner, an approved permission scope, and a revocation path before production use.
- Separate advisory AI from acting AI Classify where AI only recommends versus where it can execute actions, then require stronger controls and human approval wherever execution is possible.
- Apply least privilege dynamically Replace broad standing access with task-scoped permissions that expire when the AI action, workflow, or business context ends.
- Log and review AI-generated actions Capture the decision, the identity used, the permissions exercised, and the approval path so governance can validate what the system actually did.
Key takeaways
- AI security is moving into identity territory because the main control question is now who or what can act inside enterprise workflows.
- NIST’s Cyber AI Profile reinforces that ownership, permissions, and continuous review are not supporting controls, but the core of AI governance.
- Practitioners should govern AI systems as authorised actors with bounded access, explicit accountability, and revocation tied to actual use.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article centers on governance, ownership, and accountability for AI systems. |
| Recommendation — Establish AI governance with named owners, permission boundaries, and review for every action-capable system. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Permissions and authorisation are the core operational controls discussed throughout the article. |
| Recommendation — Apply PR.AA-05 to bound AI permissions and revoke access when scope changes. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article’s concern is AI systems acting with delegated access and misused privileges. |
| Recommendation — Treat action-capable AI as privilege-bearing and restrict what it can do at runtime. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | AI systems acting in workflows are effectively non-human identities and can be overprivileged. |
| Recommendation — Audit AI-linked identities for excess privileges and reduce them to task-scoped access. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article discusses attacks that scale through compromised credentials and delegated permissions. |
| Recommendation — Map AI-enabled abuse paths to credential access and lateral movement to sharpen detections. | ||
Key terms
- Action-Capable AI Agent: A software system that can choose actions and use tools at runtime, not just produce text. When it can query systems or trigger workflows, it inherits access, audit, and approval requirements similar to other privileged systems, which makes identity governance essential.
- AI-Driven Identity Governance: AI-driven identity governance uses machine analysis to process large volumes of identity data, identify anomalies, and prioritize risky access for human review. It does not replace governance owners. It helps them act on the data they already have by adding pattern recognition, contextual scoring, and decision support at scale.
- Continuous Risk Evaluation: Continuous risk evaluation is the practice of reassessing trust after initial proofing, using fresh signals from behaviour, device context, session history, and downstream events. It allows organisations to detect when an account or interaction no longer fits the original assurance level and to escalate verification or revoke access.
- Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
What's in the full article
C1.ai's full blog post covers the operational detail this post intentionally leaves for the source:
- How NIST IR 8596 maps AI security into CSF 2.0 and the AI RMF
- The article’s full breakdown of inventories, ownership, permissions, and continuous risk review
- Practical guidance on applying human-in-the-loop approvals to AI-assisted actions
- The broader framing of AI as a control-plane issue for identity and security teams
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org