TL;DR: A broader identity shift is putting control-plane strain on IAM, as 96,000 entitlements per worker, 38% dormant IdP accounts, and only 55% of permissions are safe and compliant show, according to Veza. The practical lesson is that entitlement sprawl, dormant accounts, and unsafe permissions now need to be governed as one lifecycle problem, not separate IAM tasks.
At a glance
What this is: This update frames enterprise identity as a control-plane problem, arguing that entitlement sprawl, dormant accounts, and unsafe permissions now interact with AI agents and NHIs.
Why it matters: IAM and IGA teams need to treat human, machine, and agent identity governance as one operating model because fragmented controls no longer match how access accumulates.
By the numbers:
- 38% of IdP accounts are dormant, according to Veza’s 2026 State of Identity and Access Report.
- Only 55% of permissions are safe and compliant, according to Veza’s 2026 State of Identity and Access Report.
Context
Enterprise identity is no longer just about authenticating people or periodically reviewing access. The problem now is control-plane sprawl: permissions, dormant accounts, and non-human access paths accumulate faster than traditional governance cycles can reconcile them.
Veza’s April 2026 update sits in that broader shift, where AI agents and NHIs create more access relationships than IAM teams can comfortably manage as separate programmes. The practical question is not whether identity governance still matters, but whether it can keep up when the governed object is a living control plane rather than a static directory.
Key questions
Q: What breaks when identity reviews focus only on entitlements?
A: You lose sight of whether access is dormant, excessive, or actively abused. A permission list can look acceptable while the actual account is unused, over-scoped, or behaving suspiciously. That creates false confidence, which is exactly what attackers need when they try to operate through valid credentials.
Q: Why do AI agents change the access-control model compared with service accounts?
A: AI agents make decisions at runtime based on text they read, so the input can influence the action. A service account usually repeats the same behavior, but an agent can be induced to take steps its authorizing user never intended. That is why identity attribution and per-request authorization matter: they preserve who approved the action and limit blast radius when the agent is manipulated.
Q: How can teams tell whether permission sprawl is becoming a governance problem?
A: Look for growing entitlement counts, dormant accounts, and permissions that stay active after the business task changes. Those signals show that access has become a standing property of the environment rather than a controlled decision. When that happens, the organisation is managing accumulation, not governance.
Q: How do human, machine, and agent identities differ in one application stack?
A: Human identities authenticate people, while machine and agent identities authenticate workloads or software entities that may act without a person present. They should not share the same lifecycle assumptions, review cycles, or trust boundaries. The safest model is to govern each actor type separately, even when the application uses one identity platform.
Technical breakdown
Why entitlement sprawl breaks traditional access models
Entitlement sprawl happens when users accumulate far more permissions than any team can meaningfully review by hand. In this case, the article’s own figures show the scale: 96,000 entitlements per worker, 38% dormant IdP accounts, and only 55% of permissions safe and compliant. That combination signals that the problem is not a single misconfiguration but a governance model that treats access as a set of isolated grants instead of a continuously changing graph. For IAM and IGA teams, the technical challenge is proving which permissions still map to real business need.
Practical implication: move from periodic review of individual entitlements to graph-based visibility across accounts, roles, and permissions.
How AI agents and NHIs change the identity control plane
AI agents and NHIs introduce access paths that behave differently from human users because they can be created, delegated, and retired at machine speed. The control-plane issue is that each agent or service account can inherit broad permissions from the systems that enable it, then keep those rights longer than the task that justified them. Once that happens, identity governance stops being about user lifecycle alone and becomes about the lifecycle of every actor that can request or exercise access. The article’s framing points to a merged governance surface for human IAM, NHI governance, and emerging agent identity controls.
Practical implication: classify and govern agents, service accounts, and human accounts in one entitlement model instead of separate inventories.
What safe and compliant permissions really means in practice
A permission can be technically valid and still be unsafe in operational terms if it survives past its intended use, crosses environments, or grants more privilege than the task requires. The 55% safe and compliant figure matters because it suggests that access quality is now a measurable governance outcome, not a soft control discussion. In practice, teams need to ask whether permissions are narrowly scoped, time-bounded, and tied to current ownership. If not, the environment may be compliant on paper while still carrying excess blast radius across human, machine, and agent identities.
Practical implication: define access quality metrics that measure scope, duration, and ownership, not just assignment status.
Threat narrative
Attacker objective: The attacker seeks to exploit excess and stale permissions to move through the enterprise identity graph and reach higher-value systems.
- Entry begins when permissions are assigned broadly enough that accounts and agents inherit more access than the task requires.
- Escalation follows as dormant identities and over-entitled actors retain reachable permissions that outlive active business need.
- Impact emerges when those permissions are used to amplify identity-based attacks across a control plane that was never designed for this scale.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Enterprise identity is becoming a control-plane discipline, not an account-admin task. When a typical worker can sit behind 96,000 entitlements, the governing object is no longer a single account but the web of relationships around it. That changes how teams should think about ownership, review, and blast radius. The implication is that IAM and IGA need to operate as one control plane across humans, NHIs, and agents.
Entitlement sprawl is now the dominant governance failure mode. Dormant IdP accounts and oversized permission sets are not separate hygiene issues; they are symptoms of the same structural problem. The identity graph has outgrown review cycles built for slower, more stable access patterns. Practitioners should treat permission volume and permission quality as linked indicators of governance debt.
Human IAM assumptions do not scale cleanly into agent identity. Access review cadences were designed for identities that persist long enough to be recertified. That assumption breaks when AI agents and machine identities are created, delegated, and retired at machine speed. The implication is that lifecycle governance has to move closer to issuance, delegation, and revocation events.
Safe and compliant access must be measured as an outcome, not an inventory label. The report’s 55% figure is a reminder that compliance status alone does not describe operational risk. A permission can be approved and still be too broad, stale, or misaligned with current use. Practitioners need governance metrics that expose scope, duration, and ownership drift before those conditions become attack paths.
Named concept: identity control plane drift. This is the gap between the speed at which identities, entitlements, and agents accumulate access and the speed at which governance can re-establish legitimacy. It matters because drift turns access management into a reactive exercise instead of a control function. The practical conclusion is that organisations must govern the control plane itself, not only the identities inside it.
What this signals
Identity control-plane drift is the right lens for this shift: access is being accumulated faster than governance can re-legitimise it. That means programme leaders should expect more value from lifecycle-triggered controls, ownership reconciliation, and graph-level visibility than from another round of static access review.
The practical threshold is no longer how many identities exist, but how quickly the organisation can prove each permission still belongs. For teams running human IAM, NHI governance, and agent identity together, the programme design question is whether those domains can be governed as one entitlement system.
For practitioners
- Map the identity control plane Create one inventory of human users, service accounts, AI agents, and the entitlements they carry so governance can follow access relationships instead of isolated accounts.
- Measure permission quality Track scope, duration, and current ownership for permissions, then flag access that remains valid but no longer matches the business task or actor.
- Reduce dormant identity exposure Prioritise dormant IdP accounts and stale non-human identities for offboarding or revocation before they become reusable footholds in the access graph.
- Shift reviews toward lifecycle events Tie access review triggers to issuance, delegation, and revocation points for agents and service accounts, rather than relying on slow periodic recertification alone.
Key takeaways
- The article describes a control-plane problem in which entitlements, dormant accounts, and non-human access now move faster than traditional IAM governance.
- Its evidence points to severe access accumulation, including 96,000 entitlements per worker, 38% dormant IdP accounts, and only 55% of permissions being safe and compliant.
- The governing response is to manage identities, permissions, and lifecycle events as one graph so review, ownership, and revocation reflect how access actually behaves.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on oversized permission sets and control-plane sprawl across non-human access. |
| NHI-01 — Improper Offboarding | Dormant IdP accounts and stale access point to offboarding and revocation gaps. | |
| NHI-07 — Long-Lived Secrets | Persistent access in the control plane often survives as long-lived credentials or standing entitlements. | |
| Recommendation — Reduce overprivileged NHI access by scoping permissions to the task and continuously reconciling ownership. Revocate dormant identities promptly and verify that offboarding removes both human and machine access. Shorten credential and entitlement lifetimes so access expires with the underlying business need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about how permissions are granted, tracked, and governed across the enterprise. |
| Recommendation — Use PR.AA-05 to continuously validate entitlements against current roles, ownership, and business need. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Excess access and dormant identities create conditions for credential abuse and movement through the identity graph. |
| Recommendation — Map excess entitlements to credential access and lateral movement risk in your threat detection priorities. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is the core control principle challenged by the entitlement volume described in the article. |
| Recommendation — Apply AC-6 to remove standing excess privileges and revalidate access against the minimum required scope. | ||
| NIST Zero Trust (SP 800-207) | Section 3.3 — Zero Trust logical components | The control-plane framing aligns with continuous verification and dynamic authorization in Zero Trust. |
| Recommendation — Apply Zero Trust principles to treat identity and entitlement as continuously evaluated signals rather than static grants. | ||
Key terms
- Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
- Entitlement Sprawl: The gradual accumulation of too many discrete permissions, often with overlapping access and unclear ownership. It makes access review noisy and offboarding fragile. Grouping entitlements into profiles is one way to reduce that sprawl, provided the groups are designed around real work patterns.
- Dormant Identity: A non-human identity that is no longer actively used but still has valid access. Dormancy is risky because it looks harmless while preserving credentials, permissions, and trust relationships that can still be abused or accidentally triggered.
- Permission Quality: Permission quality describes whether access is scoped, timely, and still aligned to current business use. High permission quality means the grant is narrow, owned, and explainable, while poor quality signals that authorised access may still be operationally unsafe.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 25, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org