ServiceNow acquires Veza: identity control plane implications

At a glance

What this is: This is an acquisition-driven identity consolidation story that centers on control-plane governance for human, NHI, and AI agent access.

Why it matters: It matters because IAM teams now need to reassess how authorization, lifecycle governance, and policy enforcement hold up as agentic workflows expand across the enterprise.

By the numbers:

• Forrester projects identity and access management spending will reach approximately $27.5 billion by 2029.

👉 Read Veza's acquisition note on identity control planes and agentic enterprise governance

Context

ServiceNow's acquisition of Veza is really about identity governance moving closer to the control plane of enterprise work. The article argues that authorization, not just login, is the layer that determines who or what can take action on data, across humans, non-human identities, and AI agents.

That framing matters because agentic workflows increase the number of identities that can act without a person in the loop. In that model, legacy directory-centric IAM is too narrow, because it does not explain or control the full set of permissions, delegated actions, and access paths that modern enterprises now need to govern.

For practitioners, the question is not whether identity matters more. It is whether current governance models can keep pace with the combination of human access, workload identity, and AI agent execution that the article describes. For teams running hybrid IAM and NHI programmes, this is an increasingly common operating model, not an edge case.

Key questions

Q: What breaks when access management is separated from identity governance?

A: Teams gain the ability to grant access but lose confidence that access remains appropriate over time. That usually shows up as privilege creep, weak offboarding, and poor audit evidence. The result is an IAM programme that can authenticate users but cannot reliably explain or correct entitlement state.

Q: Why do non-human identities complicate standard IAM reviews?

A: Because their value does not map cleanly to a human job role. An NHI may outlive the project that created it, keep active credentials for years, and still show up as valid in systems of record. Reviewers need purpose, usage, and ownership context to make a sound decision.

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: What do IAM teams get wrong about service accounts and AI agent permissions?

A: They often assume the user token or service account scope fully describes the agent’s risk. In practice, an agent can chain multiple operations within one session and operate with broader effective reach than the user intended. The control objective is not just identity binding, but action scoping.

Technical breakdown

Authorization graphs and effective access visibility

An authorization graph models who can do what to which resource by connecting identities, entitlements, policies, and inheritance paths. That is different from a directory, which mainly records accounts and group membership. The technical value is in resolving effective access, meaning the access that exists after roles, nested permissions, indirect grants, and inherited privileges are applied. In NHI-heavy environments, this matters because service accounts, tokens, and agent identities often accumulate access outside the systems that originally issued them. Without graph-based visibility, least privilege is only theoretical.

Practical implication: map effective access for NHI and agent identities before you attempt privilege reduction.

Control plane governance for human and non-human identities

A control plane is the policy and orchestration layer that decides how access is governed across systems. In identity terms, that means centralizing authorization logic, lifecycle decisions, and privilege changes instead of leaving them scattered across applications. The article positions this as necessary because agentic enterprises create more delegated actions than human-centric IAM was built to supervise. For NHI governance, the important shift is that access review, entitlement changes, and exception handling need to cover machine and agent identities with the same rigor applied to users.

Practical implication: align access governance, offboarding, and exception handling across human, workload, and AI agent identities.

Why AI agents change the identity surface area

AI agents expand identity surface area because they can initiate actions, use tools, and operate across multiple systems as part of a workflow. Even when they are not fully autonomous, they still consume credentials, invoke APIs, and inherit permissions that must be governed. That creates a different problem from classic SaaS access, because the issue is not only whether an account exists, but whether the identity can safely execute the actions it is able to take. This is where NHI and agentic AI governance overlap: both depend on knowing what access exists, how it is used, and when it should be removed.

Practical implication: treat agent identities as governed executors, not just another application integration.

NHI Mgmt Group analysis

Control-plane identity governance is becoming the category boundary. The article shows that enterprises are no longer solving identity as a login problem. They are trying to govern authorization across users, workloads, and AI agents in one place, which raises the bar for any IAM or NHI programme. The practical conclusion is that identity teams will be judged on whether they can explain effective access, not just authenticate accounts.

Authorization graphs are the right mental model for modern NHI governance. Siloed directories cannot answer who can take action on what data once permissions are inherited, delegated, or embedded in service accounts and agent workflows. That makes access graphs more than a reporting layer. They become the operational model for proving least privilege, detecting excess access, and supporting recertification across all non-human identities.

Agentic workflows make identity lifecycle governance a shared problem across humans and machines. Offboarding, entitlement review, and exception handling no longer stop at employee accounts. When AI agents and service identities can act inside business workflows, lifecycle events must cover the identity that executes the action, not just the human that requested it. Practitioners should expect governance models to converge around the actor that actually holds authority at runtime.

Identity surface area now grows faster than traditional IAM controls can absorb. The article's scale argument is less about one acquisition and more about enterprise operating reality: cloud, SaaS, NHI, and AI agents are all expanding access complexity at once. That increases the cost of weak visibility and makes authorization drift a board-level risk. Teams should assume the next control failure will come from unmanaged delegated access, not only from failed authentication.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• The same study found that 46% confirmed a breach of non-human identities and 26% only suspected one, which shows how often visibility fails before remediation begins.
• For a deeper governance baseline, see Ultimate Guide to NHIs for lifecycle, visibility, and offboarding patterns that help reduce authorization drift.

What this signals

Identity control planes will become the default language for NHI governance. As enterprises fold service identities and AI agents into the same operational layer as human access, teams will need one view of ownership, authority, and revocation. That shift makes the lifecycle of non-human access more important than the system where the credential first appeared.

With 72% of organisations already reporting or suspecting an NHI breach according to The 2024 ESG Report: Managing Non-Human Identities, visibility alone is no longer enough. The next programme gap is proving which permissions are still justified after the business process, integration, or agent that needed them has changed.

For practitioners

• Rebuild access reviews around effective permissions Shift certification from account lists to effective access paths, including nested roles, inherited entitlements, and delegated permissions that service accounts or AI agents can actually use.
• Inventory non-human and agent identities together Create a single inventory for service accounts, API keys, tokens, certificates, and AI agent identities so lifecycle owners can see where authority exists and where it was never retired.
• Tie authorization changes to ownership and offboarding Require every privileged NHI or agent identity to have a named owner, a purpose, and an offboarding condition so access does not survive the workflow it was created for.
• Measure privilege drift across control planes Compare entitlements in application, cloud, and identity layers so you can spot permissions that are technically valid but operationally unjustified.

Key takeaways

• The article's core message is that identity governance is shifting from account administration to control-plane authorization.
• The governance gap is not limited to human users, because service identities and AI agents now carry business authority that must be reviewed and revoked.
• Practitioners should respond by measuring effective access, ownership, and lifecycle state across all identity types, not by relying on directory completeness.

Key terms

• Authorization Graph: An authorization graph is the network of identities, resources, roles, and inheritance rules that determine access decisions. In practice, it must stay consistent with the application's structure or it becomes a source of drift, exceptions, and maintenance overhead.
• Effective Access: The actual permissions an identity can exercise after inheritance, nested groups, delegation, and object-level controls are evaluated. In Active Directory, effective access is more useful than direct membership because it reveals the true operational reach of a service account.
• Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
• Agent Identity: An agent identity is the set of attributes, credentials and permissions assigned to an autonomous software entity. It is treated as a non-human identity because it can authenticate, act on systems and accumulate access over time, which creates governance, audit and lifecycle obligations similar to other production identities.

What's in the full analysis

Veza's full article covers the operational detail this post intentionally leaves for the source:

• The access-graph approach Veza uses to answer who can take what action on what data across enterprise systems.
• The specific business case for unifying human, non-human, and AI agent governance in a single control plane.
• The article's broader market rationale for why authorization is becoming central to modern identity architecture.
• The original language around ServiceNow integration and the Enterprise Agent Identity Control Plane.

👉 Veza's full article adds the company's own framing on access graphs, AI agents, and the ServiceNow integration.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.