TL;DR: Identity context, least privilege, and access governance are moving into the center of AI-era security operations as ServiceNow’s acquisition of Veza signals, according to Veza; the market is now treating human, non-human, and agentic identities as one control problem, and static access models are no longer enough for modern enterprise risk.
At a glance
What this is: ServiceNow’s acquisition of Veza is presented as a market signal that identity governance is moving from a supporting control to a central security and workflow layer for human, non-human and agentic identities.
Why it matters: IAM, IGA and PAM teams should treat this as evidence that identity context, privilege scope and access governance are becoming mandatory inputs to modern enterprise security operations.
Context
ServiceNow’s acquisition of Veza is a market event, but the underlying issue is governance: enterprises now run on a mix of human users, service accounts, API keys and AI agents, and static access models struggle to keep pace with that mix. Identity has become the control plane where access, trust and business process intersect.
The article’s central claim is that identity context is now necessary to judge risk, not just identity presence. That matters for NHI governance because the same access governance logic that once focused on people is now being asked to cover machine identities and, increasingly, agentic systems that can act at runtime.
Key questions
Q: Where do static access reviews fail in mixed human and non-human identity estates?
A: Static access reviews fail when they assume permissions stay stable long enough to be examined and certified. In estates with service accounts, API keys and AI agents, access can be created, used and outgrown faster than review cycles. The result is governance that documents risk after the exposure window has already closed.
Q: Why does identity context matter more than role assignment in modern enterprise access governance?
A: Role assignment tells you what was granted, but identity context tells you what can actually happen across systems and data. A single entitlement can have very different risk depending on the application, the dataset, the delegated path and whether the identity is human or machine. Governance improves when teams measure effective reach, not just intended access.
Q: What breaks when agentic identities are reviewed like human users?
A: Human-style access reviews break because they assume the subject is observable on a schedule and can be certified in a stable state. Agentic identities may change scope, act repeatedly, or finish a task before the next review cycle begins. As a result, the review process sees the wrong state or no useful state at all.
Q: How should IAM teams respond when identity protection becomes a platform consolidation story?
A: They should re-check whether governance, lifecycle management, and enforcement are still split across different owners and tools. Consolidation changes the operating model, so the key question is not which vendor wins, but whether the programme can still prove coverage across human and non-human identities without duplicate control gaps.
Technical breakdown
Why static access models fail in mixed identity estates
Static access models assume permissions can be understood and governed at provisioning time, then periodically checked later. That assumption breaks when enterprises combine human accounts, service identities, API keys and AI agents across hundreds of systems. In those environments, entitlement shape changes faster than review cycles, and the same identity can expose very different data or actions depending on the system context. Identity governance has to reason over operational scope, not just account state.
Practical implication: build governance around observed access paths and data reach, not only assigned roles.
What an access graph changes for identity governance
An access graph normalises permissions metadata across SaaS, cloud, data platforms and custom applications so teams can answer who can do what, on which data, and through which identity. That matters because least privilege is not just a policy statement; it is an evidence problem. Without cross-system visibility, teams cannot distinguish dormant access from active risk, or identify where an identity’s effective blast radius is larger than the assigned role suggests.
Practical implication: consolidate entitlement data across systems before attempting meaningful least-privilege remediation.
Why agentic identities push governance beyond human audit cycles
Agentic identities can create and use access in ways that are faster and more dynamic than human reviewers can track. Once AI agents become active enterprise actors, governance cannot rely on post-hoc inspection alone because access may be acquired, used and discarded inside short execution windows. That shifts the control problem toward runtime visibility, scoped authorisation and explicit accountability for machine actions, which is materially different from human access certification.
Practical implication: evaluate whether your current access reviews can even observe the identities they are meant to govern.
Threat narrative
Attacker objective: The attacker aims to turn legitimate identity relationships into broad access to data and business processes without triggering traditional perimeter-based controls.
- Entry begins when identity becomes the access boundary, not the network perimeter, so compromised or excessive privileges provide the attacker’s starting point.
- Privilege escalation occurs when standing access, stale entitlements or opaque delegated permissions expand what an identity can reach across systems.
- Impact follows when that access is used to read, alter or exfiltrate sensitive data, or to drive business workflows through trusted identities.
NHI Mgmt Group analysis
Identity context, not identity count, is now the governance problem. Enterprises are not dealing with a single access model anymore. They are trying to govern humans, service accounts, API keys and AI agents through the same operational fabric, which makes simple provisioning logic insufficient. The practical conclusion is that identity governance must be judged by how well it explains effective access across systems, not by how many identities it can list.
Least privilege becomes meaningful only when it is measurable across the full access graph. The article points to a core shift: permissions metadata across cloud, SaaS and custom applications can now be normalised into a single view of who can act on what. That is the difference between policy intent and operational control. Practitioners should treat cross-system entitlement visibility as the prerequisite for any serious least-privilege programme.
Static review cadences were designed for human-paced access, and that assumption fails under agentic behaviour. Human-driven audits presuppose that access persists long enough to be reviewed and certified. Agentic identities can obtain and use permissions at runtime, which means the review window can close before the review starts. The implication is that governance teams must rethink whether certification remains the right control model for all identity types.
"Identity-first" is becoming a control architecture, not a slogan. The article frames identity as the point where risk, trust and workflow converge, which is exactly why platform consolidation is accelerating in this category. For practitioners, the significance is not the acquisition itself but the direction of travel: identity governance is moving closer to operational execution, and programme boundaries between IAM, IGA and PAM are narrowing.
Identity blast radius will become a primary decision variable for security programmes. The article’s emphasis on operational scope, dormant access and lateral-movement risk reflects a broader market truth. Teams will increasingly have to rank identities by the damage they could do, not only by what they are allowed to do. That is a stronger governance model for modern enterprise estates.
What this signals
Identity blast radius: the practical unit of governance is shifting from account ownership to reachable data and executable workflow scope. That change matters because the same identity can be low risk in one system and high risk in another, so programme maturity now depends on measuring effective reach across the full estate.
Access review cadences will matter less if they are not paired with runtime visibility. For service accounts and agentic identities, the governing question is whether access can be observed at the moment it is used, not just after it is granted or recertified.
For practitioners
- Map effective access across systems Build a cross-platform view of who can reach sensitive data, administrative functions and workflow actions across SaaS, cloud and custom apps.
- Measure identity blast radius Score identities by data reach, privileged scope, dormant access and lateral-movement potential so remediation is driven by operational exposure.
- Rework access reviews for non-human identities Stop assuming periodic certification alone can govern service accounts, API keys and agentic identities that change scope faster than review cycles.
- Separate human review from machine enforcement Use policy and runtime controls to reduce reliance on manual audit for identities that operate at machine speed and across multiple systems.
Key takeaways
- The acquisition points to a market where identity governance is becoming a core control layer for humans, machine identities and agentic systems.
- The hard problem is not identity inventory alone, but understanding effective access, privilege scope and blast radius across many connected systems.
- Programmes that still depend on static roles and periodic reviews will struggle to govern identities that operate faster than the review cycle.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on measuring and reducing excess access across machine and agent identities. |
| NHI-09 — NHI Reuse | The article highlights the same identity controls spanning humans, workloads and agents across the enterprise. | |
| Recommendation — Map overprivileged identities to NHI-05 and remove unnecessary permissions across connected systems. Track reused identity patterns to NHI-09 and separate shared access paths from accountable ownership. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The piece is fundamentally about governing entitlements and effective access across the enterprise. |
| Recommendation — Apply PR.AA-05 to continuously verify who can access what data and actions. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is the article's central governance theme for human and machine identities. |
| Recommendation — Use AC-6 to constrain identity permissions to the minimum required for each task. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article links identity context to credential misuse and lateral movement risk. |
| Recommendation — Prioritise detection around credential access and lateral movement paths exposed by excessive entitlements. | ||
Key terms
- Identity context: The entitlement, ownership, and purpose information that explains why an action occurred and whether it was expected. For security operations, identity context turns raw alerts into decisions by showing which human or non-human identity acted and what it was allowed to do.
- Access Graph: An access graph is a relationship model that links identities, permissions, data objects, and system interactions. In NHI governance, it helps security teams see the full path from an agent or user to the action it can take, which is more useful than isolated account reviews.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 25, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org