ServiceNow acquires Veza: identity control plane implications

At a glance

What this is: ServiceNow’s acquisition of Veza positions identity control as a platform layer for human, non-human and AI agent access governance.

Why it matters: IAM and NHI teams need to reassess how authorization, not just authentication, is governed when identity becomes part of the enterprise control plane.

Context

The core governance problem is no longer just proving who signed in. It is determining who or what can act, on which data, and under which authority across human users, service identities and AI agents.

This acquisition frames identity as an operational control plane rather than a directory-only function. That matters because agentic workflows expand the number of identities that can exercise access, and they do so across more business processes than traditional IAM models were built to inspect.

For practitioners, the issue is whether access decisions remain enforceable and explainable as identity moves deeper into workflow automation, AI orchestration and cross-domain authorization.

Key questions

Q: How should security teams govern identity as a control plane?

A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate. That means combining IAM, PAM, and NHI lifecycle controls with continuous evaluation, machine-readable policy, and delegation tracking. If identity is only provisioned and not governed, the rest of the stack is protecting decisions that were never validated.

Q: Why do AI agents complicate traditional IAM reviews?

A: Traditional IAM review assumes identities have human lifecycle events such as hire, role change, or offboarding. AI agents do not follow that pattern, so access can drift silently unless teams build continuous entitlement governance. Without that shift, reviews become retrospective paperwork instead of active risk reduction.

Q: What breaks when organisations audit AI agents like service accounts?

A: Audit trails break when teams record only the API call and ignore the prompts, tools, and model outputs that caused it. For AI agents, the explanation for an action is part of the evidence chain, and without it incident response cannot reliably reconstruct intent or accountability.

Q: What is the difference between application authentication and identity governance?

A: Authentication proves a user can sign in. Identity governance proves the right user still has the right access over time, with traceability and lifecycle control. Applications that stop at login can function technically while still failing compliance, access review, and offboarding expectations.

Technical breakdown

Authorization data as the identity control plane

Authorization data is the record of what a subject can do, not simply who the subject is. In modern enterprises, that means entitlements, permissions, relationships and policy context matter as much as authentication events. The article’s emphasis on a canonical data model reflects a broader shift: if organisations cannot normalise access data across systems, they cannot answer high-value questions about excessive privilege, toxic combinations or non-compliant access. That is especially true when the same governance logic must span users, service accounts and AI agents.

Practical implication: Map access decisions to a consistent authorization model before trying to automate governance across tools and workflows.

Why AI agents strain conventional IAM models

AI agents are not just another workload. They can initiate actions, select tools and move through workflows in ways that create more dynamic access patterns than static role assignment was designed to handle. Traditional IAM assumes relatively stable subjects, known contexts and reviewable privileges. Agent-driven work breaks those assumptions because the identity can change its effective access path as the task unfolds. That makes entitlement visibility and policy enforcement a runtime problem, not only a provisioning problem.

Practical implication: Treat agent access as a runtime authorization issue and define how agent decisions are constrained before they reach sensitive systems.

Least privilege depends on governance of unused access

The article’s discussion of removing risky, unneeded, unused or non-compliant permissions gets to the heart of least privilege. Least privilege is not achieved by naming roles alone. It depends on continuous understanding of which permissions are actually exercised and which linger after business use has ended. In environments with cloud, SaaS, on-prem systems and NHI sprawl, unused access becomes a standing exposure that can outlive the original business need.

Practical implication: Continuously identify unused and non-compliant access so entitlement cleanup becomes part of identity operations, not a periodic audit exercise.

NHI Mgmt Group analysis

Identity is becoming a control plane because authorization, not authentication, now determines enterprise risk. The article reflects a structural shift that many IAM programmes have been slow to acknowledge. Once access spans users, service identities and AI agents, the decisive governance question becomes what each subject can do after it is authenticated. Practitioners should treat authorization as the primary boundary for enterprise control.

The Access Graph concept is really a governance model for effective privilege. A directory can tell you who exists, but it cannot reliably tell you who can act on what data across fragmented systems. The control-plane framing is therefore less about product architecture than about whether entitlement data is complete enough to support least privilege, compliance and operational review. That is the standard identity teams should apply.

AI agents expose the limits of review-based governance when access becomes more dynamic than the review cycle. Human IAM processes still dominate many identity programmes, but agentic work changes the tempo of access decisions. If an identity can request, combine and consume access inside a task flow, then annual or quarterly attestation no longer reflects actual exposure. The implication is that identity governance must move closer to issuance and execution.

Enterprise platforms are moving to absorb identity governance because identity is now inseparable from workflow control. That does not remove the need for specialised identity design. It increases the need for clear operating boundaries between workflow orchestration, authorization policy and identity lifecycle control. Practitioners should expect more platform consolidation but should not confuse consolidation with solved governance.

Control-plane language is useful only if it forces measurable governance outcomes. If identity is truly the control plane, organisations should be able to show reduced excess privilege, faster access decisioning and better evidence for compliance reviews. The field should judge these initiatives by whether they reduce entitlement ambiguity, not by whether they sound more strategic. That is where maturity will be measured.

What this signals

Authorization governance is now the programme-level bottleneck. As enterprises extend identity beyond humans into service identities and AI agents, the limiting factor is no longer sign-in policy but whether access intent can be expressed, enforced and audited consistently. That pushes identity teams toward policy normalisation, entitlement cleanup and stronger operational ownership of access decisions.

Identity sprawl is becoming workflow sprawl. When orchestration platforms and AI-driven processes participate in access decisions, the number of places where privilege can be created, inherited or retained expands quickly. Teams should watch for control gaps where workflow automation is allowed to imply authorization without a clear governance layer.

Control-plane thinking only pays off if it reduces ambiguity in effective privilege. The practical test is whether teams can identify unnecessary access faster, remove it with less friction and prove the decision later. If they cannot, the architecture may be more consolidated, but the governance problem is still intact.

For practitioners

• Define the enterprise authorization model Establish a canonical view of who can take what action on what data across human, NHI and AI agent identities. Use it to normalise entitlements before you attempt cross-platform governance.
• Inventory non-human and agent access paths Map the access paths used by service accounts, API-driven workflows and AI agents, then identify where privilege is inherited, duplicated or left unused.
• Separate workflow control from access authority Do not let orchestration layers become the implicit source of authorization truth. Keep policy decisions explicit so action permission can be reviewed and revoked independently of workflow design.
• Measure unused and non-compliant access Track entitlements that are risky, unneeded or no longer exercised, and make removal part of operational governance rather than annual recertification alone.

Key takeaways

• The article’s central shift is from identity as a login layer to identity as an authorization control plane across people, machines and AI agents.
• The governance challenge is not just visibility. It is whether organisations can answer who can do what, on which data, with evidence that holds up operationally and for compliance.
• Practitioners should focus on canonical authorization data, unused access removal and runtime constraints for agents before treating platform consolidation as a solved identity strategy.

Key terms

• Authorization Data Sharing: The practice of making authorization evidence available directly from provider-controlled systems rather than forcing repeated manual uploads. It supports continuous review and reuse, but only works when the underlying identity, control, and monitoring data is trustworthy and consistently mapped.
• Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
• Effective Privilege: Effective privilege is the real access an entity can exercise after inheritance, delegation, token scope, and connected-system trust are applied. It is often broader than the permissions shown in an identity repository, which is why runtime validation matters.
• Canonical Access Model: A canonical access model is a standardised way to represent who can access what across multiple systems. It reduces ambiguity by making permissions, relationships and policy decisions comparable, which is essential when identity governance spans human users, machines and agents.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.