Silverfort acquires Fabrix: identity security shifts to runtime

At a glance

What this is: This is an analysis of why identity security is shifting from preapproved access and periodic review toward runtime decisioning and inline enforcement as AI agents and non-human identities accelerate access risk.

Why it matters: IAM, PAM and NHI teams need to reassess controls built for admin-time policy because access decisions increasingly have to happen at the point of use, not after the fact.

Context

Identity security is the discipline that decides who or what can access which systems, data, and actions, and under what conditions. Fabrix Security argues that the old model of defining access in advance and reviewing it later no longer fits environments where non-human identities, AI agents, and fast-moving risk change the decision point.

The governance gap is timing. Static policy and periodic certification assume access remains stable long enough for review, but runtime behaviour now changes inside the access window. In practical terms, this is an identity governance problem for both human and non-human identities, with autonomous behaviour making the timing gap even harder to absorb.

Key questions

Q: What breaks when identity reviews assume access will stay stable long enough to assess?

A: The review process breaks when access can be abused, chained, or abandoned faster than the governance cycle can inspect it. AI-assisted attackers can exploit connected identities in minutes, leaving human-centric review cadences permanently behind the actual risk. Organisations need continuous validation and rapid revocation paths instead of relying on scheduled checks.

Q: Why do AI agents increase non-human identity risk?

A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission. That speed expands blast radius, shortens attacker dwell time, and makes weak delegation more dangerous. The remedy is tighter scoping, continuous verification, and strict separation between observation and execution privileges.

Q: How should security teams evaluate runtime enforcement versus advisory analytics?

A: Security teams should ask whether a control can actually stop or constrain access in the same path where the request occurs. If the system only reports, recommends, or alerts after the event, it is useful for detection but not sufficient for identity enforcement. Runtime enforcement is the difference between informing governance and applying it.

Q: What is the difference between static authorization and runtime decisioning?

A: Static authorization assigns access in advance based on roles or entitlements, while runtime decisioning re-evaluates the request using current context at the moment of access. The latter is better suited to volatile identities, changing risk, and AI-driven activity because it reflects what the identity is trying to do now, not what it was allowed to do earlier.

How it works in practice

Why admin-time authorization no longer fits runtime behaviour

Traditional IAM separates policy definition from enforcement. Administrators precompute roles, entitlements, and approval paths, then systems apply those decisions later when a user or workload requests access. That model works only when identity behaviour is predictable and access patterns are relatively stable. Fabrix Security’s premise is that AI agents and fast-changing machine activity break that separation because the relevant context emerges at the moment of use, not at provisioning time. In that setting, least privilege cannot be treated as a static assignment exercise; it becomes a continuous evaluation problem tied to current intent, asset, and risk.

Practical implication: Treat access decisions as runtime controls, not just entitlement design.

What inline enforcement changes for identity controls

Inline enforcement places the control in the authentication or access path, so a decision can be applied where the request actually occurs. That differs from dashboards, recommendations, or post-event review because those mechanisms inform governance without stopping action. For identity security, the distinction matters: if a system can evaluate context but cannot block or constrain the access flow immediately, it is advisory, not enforcing. This is especially relevant for NHI, where API keys, service accounts, tokens, and AI agents can move faster than human review cycles and can reuse access across many systems in seconds.

Practical implication: Move high-risk identities and flows into enforcement points that can stop access at request time.

Why living identity context matters more than role labels

A role says what access should exist in theory. Runtime identity context says what the identity is actually doing now, what it has done before, and whether the request fits the current business and security state. Fabrix Security’s framing points to a living identity knowledge graph as the mechanism for that broader context, combining permissions, activity, policy, and asset data. The analytical point is not that roles disappear, but that roles alone are too coarse for dynamic systems. In environments with autonomous behaviour, context becomes the only reliable way to judge whether a request remains acceptable.

Practical implication: Enrich authorization decisions with behavioural and asset context, not just static entitlements.

NHI Mgmt Group analysis

Static authorization is no longer a complete security model: Access that is defined once and reviewed later assumes identities behave within predictable windows. That assumption weakens when human, machine, and AI-driven identities can change risk posture in the middle of a session. The practical conclusion is that governance has to move closer to the moment of use.

Runtime identity decisioning is becoming the new control plane: Security programmes that treat policy as a precomputed artifact will miss the speed of modern access behaviour. The stronger model evaluates current intent, current asset, and current context before a request is allowed to proceed. That makes access control a live decisioning problem, not a paperwork problem.

Identity context is now an operational asset, not supporting data: Permissions, activity, business context, and asset relationships have to be treated as a single decision surface. Without that context, the system only knows what an identity can do on paper, not what it should do right now. Practitioners should treat context quality as a governance dependency.

Runtime enforcement exposes the gap between analysis and control: Many identity products can observe risk, but observation is not enforcement. The market is moving toward systems that can both decide and act in the same access path. That shift will force teams to re-evaluate whether their current controls actually stop unsafe access or merely describe it.

What this signals

Runtime identity is becoming the governance boundary: The practical shift is from certifying what access exists to enforcing what access is allowed at the moment of action. Programmes that still separate decisioning from enforcement will keep finding gaps between policy and execution, especially where machine identities and autonomous agents move faster than review cycles.

Autonomous behaviour invalidates access-review assumptions: Access review processes assume privilege persists long enough to be observed and certified. When identities can request, use, and discard access within a narrow operational window, certification becomes a historical record rather than a control. Teams need to rethink where governance begins: at issuance and enforcement, not after use.

For practitioners

• Rebuild approval logic around runtime context Map which access decisions still depend on admin-time policy and identify where current context, not stored role data, should drive the decision.
• Place enforcement in the access path Prioritise controls that can block or constrain access at the point of authentication or session establishment, especially for high-risk workloads and AI-driven actions.
• Separate reviewable access from ephemeral access Determine where periodic access reviews still add value and where short-lived, fast-moving access requires issuance-time controls instead of recertification.
• Inventory AI agent and workload decision points Document which identities can act without human intervention, which tools they can reach, and where a runtime decision must be made before action is taken.
• Test whether your current model can stop unsafe access Run scenarios where the identity context changes mid-session and verify whether the control path still enforces the new risk state in real time.

Key takeaways

• Identity security is shifting because preapproved access and delayed review no longer match the speed of machine and AI-driven activity.
• Fabrix Security frames the problem as a timing failure, not simply a scale problem, because risk can materialise before governance reacts.
• Practitioners should focus on runtime decisioning and inline enforcement where access actually happens, especially for non-human identities and AI agents.

Key terms

• Runtime Decisioning: The practice of making operational choices while a process is actively running instead of only before it starts. In IAM and NHI contexts, runtime decisioning can improve responsiveness, but it also makes it harder to prove why access changed unless policy inputs and decision records are preserved.
• Inline Enforcement: Inline enforcement is the technical act of applying access policy in the live session path, not just at approval time. It matters because identity governance without runtime enforcement can authorize access that the session layer never actually constrains, especially in distributed and third-party environments.
• Identity context: The entitlement, ownership, and purpose information that explains why an action occurred and whether it was expected. For security operations, identity context turns raw alerts into decisions by showing which human or non-human identity acted and what it was allowed to do.
• Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.