Opal’s access campaigns and agent governance shift IGA assumptions

At a glance

What this is: This release expands access governance across people, service accounts, and AI agents, with a focus on faster reviews, policy-as-code, and scoped agent access.

Why it matters: It matters because IAM teams now have to govern the same entitlement plane across human and non-human identities without letting review latency or agent speed widen the blast radius.

By the numbers:

• 43.5 percent of granted access goes unused, and every unused grant is standing risk.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope.

👉 Read Opal Security's post on Paladin, Access Campaigns, and OpalScript GA

Context

Access governance has moved beyond human request flows. When the same entitlement system now serves employees, service accounts, and AI agents, the control problem is no longer only approval speed. It becomes whether policy, review, and logging still hold when the actor can be machine-paced and the access path is API-driven.

Opal’s release is framed around that shift: continuous decisions, campaign-based review cleanup, policy encoded as logic, and scoped MCP access for agents. The underlying issue for identity programmes is not feature parity across identities, but whether the governance model can keep access bounded when automation and delegation blur the old human-first assumptions.

Key questions

Q: How should security teams govern IAM access for AI agents in AWS?

A: Treat each AI agent as a non-human identity with its own execution role, trust policy, and review cycle. Scope permissions to the smallest working set, remove wildcard access, and validate what the agent can actually do across downstream services. The safest control is to govern the role, not the prompt.

Q: Why do access review programmes struggle when human and machine identities share the same control plane?

A: Because reviewers need context that spans different identity types, yet many programmes still handle them as separate queues. Once service accounts and AI agents share entitlement paths with employees, review decisions depend on the full access graph, not isolated permission lists. Without that view, unused access and inherited privilege stay hidden.

Q: What breaks when access management policy is written but not enforced?

A: When policy is not enforced, access decisions drift away from business need. Users keep permissions after role changes, shared accounts remain active, and audit evidence becomes unreliable. The result is not just non-compliance. It is a control environment where entitlement, accountability, and deprovisioning no longer line up with actual use.

Q: When should organisations prioritise cleanup of unused access over adding more approval steps?

A: When a large share of access is granted but never used, review friction is no longer the main problem. The bigger issue is standing privilege that continues to exist after need has passed. In that situation, cleanup reduces attack surface faster than adding another layer of approval ever will.

How it works in practice

Access graphs now need to unify human and non-human identities

An access graph is the relationship map between identities, entitlements, systems, and approval paths. In mixed environments, the graph has to model employees, service accounts, and AI agents together or reviewers miss inherited privilege and cross-system drift. Campaigns, comparison views, and policy checks all depend on that shared graph because access decisions are only as good as the context behind them. When the graph is fragmented, entitlement review becomes a series of local decisions instead of one governance model.

Practical implication: unify entitlement visibility across all identity types before you try to automate reviews or policy enforcement.

Policy-as-code reduces reviewer variance but increases governance discipline

Policy applied manually drifts because the same request can be judged differently depending on the reviewer and the day. Policy-as-code turns decision criteria into versioned logic, which improves consistency and auditability. That also means governance teams must maintain policy like software: tested, reviewed, and controlled for change. The main value is not speed alone. It is repeatable access decisions that can be proven, not just asserted, across access requests and exception handling.

Practical implication: treat access policy as a controlled artefact with testing, versioning, and rollback, not as an informal reviewer guideline.

Scoped MCP access changes how agent requests should be governed

MCP gives AI agents a standard way to reach tools and data sources, but a protocol does not create trust by itself. If an agent can request access through the same pathways as a human developer, the control question becomes whether the access is scoped, expiring, and tied to a specific purpose. That is why approval-ready, self-hosted MCP handling matters: it narrows standing exposure while preserving operational usefulness. The security problem is not the agent label. It is whether machine-speed access still respects the same lifecycle discipline as every other identity.

Practical implication: require scoped, expiring agent access and lifecycle controls before allowing MCP-based tool use in production.

NHI Mgmt Group analysis

Access governance is becoming an identity graph problem, not just an approvals problem. When employees, service accounts, and AI agents share one entitlement plane, the old assumption that reviews can be handled in separate silos breaks down. The practical issue is not simply volume. It is that policy decisions now depend on cross-identity context that many IGA programmes still cannot model cleanly.

Policy drift is a governance failure, not a reviewer training issue. The same access request should not produce different outcomes because of reviewer judgment or timing. Policy-as-code matters because it turns access intent into an auditable control surface. For practitioners, the question is whether policy exceptions are still living in people’s heads instead of in governed logic.

Scoped MCP access is the right direction, but only when it is treated as NHI governance. A protocol for agent tool access is not a substitute for lifecycle discipline, expiry, and revocation. The implication for identity teams is that agent connectivity must be governed as a non-human identity pattern, not as a feature embedded inside AI tooling.

Unused access is the clearest sign that entitlement governance has become a blast-radius problem. If almost half of granted access is never used, the control failure is not merely inefficiency. It is lingering privilege that outlives need. That changes the governance target from “approve or deny” to “remove what should not continue to exist.”

Access campaigns are most valuable when they collapse entitlement debt before automation multiplies it. Campaigns, comparison tooling, and access review refreshes are not housekeeping features in this context. They are the mechanism that stops accumulated access from becoming the default substrate for both human and machine misuse. Teams should treat cleanup as a security control, not an admin task.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
• For the broader agentic risk picture, see AI Agents: The New Attack Surface report, where 80% of organisations reported AI agents performing actions beyond intended scope.

What this signals

Access governance is converging with machine identity lifecycle management. As access requests, policy enforcement, and MCP-linked agent activity sit inside the same control plane, teams need one entitlement model that can represent humans, service accounts, and AI agents without relying on separate review logic.

In practice, unused access is now a measurable governance liability. When 43.5 percent of granted access goes unused, cleanup becomes a direct blast-radius reduction exercise, not an administrative optimisation. Teams should expect review campaigns and policy-as-code to sit closer to operational security than to back-office IAM.

The agentic risk curve is already visible in industry data. With 80% of organisations reporting AI agents acting beyond intended scope in AI Agents: The New Attack Surface report, governance teams should plan for approval, logging, and expiry controls to be designed for runtime behaviour, not just provisioning-time intent.

For practitioners

• Unify human and non-human entitlement views Build one access model that includes employees, service accounts, and AI agents so reviewers can see inherited privilege, unused grants, and cross-system drift in the same workflow.
• Convert approval rules into versioned policy Move access decision criteria into tested policy-as-code so the same request produces the same outcome regardless of reviewer, shift, or escalation path.
• Scope agent access by task and expiry Require AI agents to use scoped, expiring access for MCP-connected tools, with revocation tied to the end of the task or workflow.
• Use campaigns to remove dormant access debt Prioritise campaigns against unused grants, stale permissions, and exceptions that have survived past the business need that created them.

Key takeaways

• Identity governance now has to cover employees, service accounts, and AI agents inside one access model.
• Unused access is not benign overhead. It is standing risk that expands the attack surface and weakens review quality.
• Policy-as-code and scoped agent access are becoming core controls for keeping machine-speed delegation inside governance boundaries.

Key terms

• Access Graph: An access graph is a relationship model that links identities, permissions, data objects, and system interactions. In NHI governance, it helps security teams see the full path from an agent or user to the action it can take, which is more useful than isolated account reviews.
• Policy as Code: Policy as code stores authorization logic in version control and evaluates it through testable, reviewable rules. For agent governance, it makes runtime decisions reproducible and measurable, which is critical when actions can be triggered by untrusted content and executed at machine speed.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.

What's in the full announcement

Opal Security's full product post covers the operational detail this post intentionally leaves for the source:

• How Paladin applies context to individual access decisions across live requests and policy exceptions
• How Access Campaigns structures reviewer assignment, reminders, and bulk cleanup for large entitlement sets
• How OpalScript encodes access policy into versioned logic for separation of duties, duration limits, and auto-approval criteria
• How the MCP updates and OAuth for Opal MCP scope agent access in production environments

👉 Opal Security's full post covers the MCP updates, integrations, and access review workflow details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.