Veza’s April 2026 update spotlights the enterprise agent control plane

At a glance

What this is: This is a product-update roundup centered on enterprise agent identity control, with the key finding that identity sprawl is now large enough to strain both human IAM and non-human governance.

Why it matters: It matters because IAM, IGA, and PAM teams now have to govern worker access, dormant accounts, and AI/NHI access patterns through one operating model instead of isolated controls.

By the numbers:

• 2026 State of Identity and Access Report found, t found that in a typical enterprise, an average worker holds 96,000 entitlements.
• Veza’s 2026 State of Identity and Access Report found that 38% of IdP accounts are dormant.
• Veza’s 2026 State of Identity and Access Report found that only 55% of permissions are safe and compliant.

👉 Read Veza's April 2026 update on the enterprise agent identity control plane

Context

Veza’s April 2026 updates are a signal that the identity control plane is being pulled into a broader governance problem. The article ties enterprise access complexity to the rise of AI agents and non-human identities, which means traditional entitlement management is now being asked to govern far more than human user access.

The underlying issue is not just volume. It is the combination of dormant identities, excessive entitlements, and mixed actor types that forces IAM, IGA, and PAM teams to reason about access as a living system instead of a static permission set.

That is a familiar pattern in mature identity programmes, but the scale is no longer typical. What used to be a human-access review problem is now also a machine-access and agent-access control problem, and those domains are converging faster than most governance models have been updated.

Key questions

Q: How should security teams handle dormant accounts without leaving downstream access behind?

A: Treat the dormant account as the starting point, not the finish line. Disable the identity, then trace linked application roles, tokens, delegated permissions, and service dependencies so access does not persist in systems the IdP cannot see. The goal is to remove entitlement residue, not just inactive usernames.

Q: Why do AI agents complicate traditional IAM controls?

A: AI agents complicate traditional IAM controls because they do not behave like human users with short, predictable sessions. They can act continuously, chain actions, and reuse the same identity across many systems. That creates a governance problem centered on access duration, revocation, and blast radius, not just authentication.

Q: What breaks when permissions are reviewed without a graph of relationships?

A: Reviewing permissions in isolation misses inherited access, shared dependencies, and downstream entitlements that survive role changes or offboarding. Without relationship context, teams certify accounts while leaving hidden pathways intact. That is how excessive access remains in place even after formal review cycles complete.

Q: How can IAM teams prioritise cleanup when entitlement sprawl is extreme?

A: Start with high-impact paths first: production systems, privileged roles, and delegated access used by workloads or agents. Then target dormant accounts and broad entitlements that contribute to the largest blast radius. This approach reduces risk faster than trying to normalise the entire estate at once.

Technical breakdown

Why the enterprise agent identity control plane matters

An identity control plane is the set of policies, graph relationships, and governance workflows that determine who or what can reach which resources. Veza’s framing matters because AI agents and NHIs do not fit neatly into old human-centric access models: they create more entities, more entitlements, and more delegation paths. When access is mapped across identities, permissions, and resource relationships, the graph becomes the only practical way to understand blast radius. The challenge is not simply discovery. It is maintaining continuous trust in a system where identity state changes faster than periodic review cycles can capture.

Practical implication: model human, service, and agent access in one graph so entitlement review is based on relationships, not spreadsheets.

Dormant identities and permission hygiene

Dormant IdP accounts are a governance signal, not just an account-cleanup metric. A dormant account can still carry delegated access, inherited roles, linked app permissions, or fallback pathways that remain exploitable even when the human user is inactive. In parallel, unsafe or non-compliant permissions show that access review has not translated into actual reduction of privilege. For IAM teams, this is where recertification, offboarding, and privilege cleanup converge. The technical problem is that permission state and identity state are often managed separately, which leaves residue behind after the user or workload should have lost access.

Practical implication: tie recertification to entitlement revocation and dormant-account suppression in the same workflow.

AI agents and NHIs as control-plane residents

AI agents behave differently from conventional service accounts because they can generate new actions across tools, resources, and context boundaries at runtime. Even when an agent is not fully autonomous, it still increases the number of identity objects that must be authenticated, authorised, logged, and constrained. That makes AI agents and NHIs control-plane residents, not edge cases. The architectural shift is toward runtime governance, where access is evaluated in context rather than assumed safe after provisioning. This is where identity security starts to overlap with agent governance and workload identity control.

Practical implication: extend identity governance policies to every agentic or machine identity that can act across tools and data sources.

NHI Mgmt Group analysis

The enterprise identity problem is now a control-plane problem, not an access-list problem. Once a typical worker carries 96,000 entitlements, the issue is no longer isolated over-permissioning. The issue is that governance can no longer be expressed as a simple review queue; it has to operate as a continuously updated relationship model across humans, NHIs, and agents. Practitioners should treat identity graph quality as a security control, not just an inventory feature.

Dormant accounts are only the visible symptom of deeper entitlement residue. An IdP account can be dormant while the access it once enabled remains embedded in downstream applications, delegated roles, and linked machine workflows. That means cleanup programmes need to look beyond account status and into inherited access paths. The implication is straightforward: lifecycle governance has to reach every dependency that survives the user session.

AI agents make the old separation between human IAM and NHI governance untenable. The article’s own direction points to a future where the same control plane must govern people, bots, service accounts, and agentic systems together. That does not mean the identities are the same. It means the governance primitives are converging, and practitioners who keep treating them as separate programmes will miss shared privilege accumulation. The practical conclusion is to unify policy logic while preserving actor-specific controls.

Named concept: the identity control-plane gap. This gap appears when organisations can see accounts and entitlements but cannot govern the relationships between them at runtime. Veza’s report points to a world where this gap grows as AI agents multiply access paths and legacy IAM controls remain account-centric. Practitioners should recognise that the gap is now structural, not tactical, and design for continuous relationship governance.

From our research:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which leaves most machine access outside continuous governance.
• From our research: Read 52 NHI Breaches Analysis to see how access residue becomes breach fuel when offboarding and rotation fail.

What this signals

The identity programme is shifting from account governance to relationship governance. When a typical enterprise reaches six-figure entitlement density, periodic access review alone stops being a sufficient control. Teams should watch for graph quality becoming a leading indicator of IAM maturity, especially where humans, service accounts, and agents share the same permission fabric.

The control-plane gap will widen before it narrows. As AI agents and NHIs multiply, the useful question is no longer whether access exists, but whether the organisation can explain why it exists and what depends on it. That calls for tighter lifecycle linkage between recertification, offboarding, and privilege reduction, backed by the Ultimate Guide to NHIs and the 52 NHI Breaches Analysis.

For practitioners

• Map entitlement relationships in one control plane Inventory how human accounts, service accounts, and agent identities relate to applications, data stores, and delegated permissions. Use the graph to identify where access is inherited rather than directly assigned.
• Re-certify dormant identities with downstream cleanup Do not stop at disabling the IdP account. Trace linked app entitlements, API tokens, and fallback roles so dormant access does not survive in downstream systems.
• Unify review workflows for humans and non-humans Run access reviews from the same governance process, but segment by actor type so human, NHI, and agent permissions are evaluated with the right approval model and logging depth.
• Prioritise high-risk permissions over broad recertification Focus first on entitlements that touch production data, privileged admin paths, and machine-to-machine delegation. That is where permission cleanup reduces risk fastest.

Key takeaways

• Identity sprawl has become a control-plane problem because entitlement volume, dormant accounts, and unsafe permissions now overlap.
• The evidence points to governance residue, not just weak account hygiene, with machine and human access increasingly managed through the same broken assumptions.
• Teams should unify graph-based review, lifecycle cleanup, and actor-specific policy so access is governed continuously instead of certified after the fact.

Key terms

• Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
• Entitlement Sprawl: The gradual accumulation of too many discrete permissions, often with overlapping access and unclear ownership. It makes access review noisy and offboarding fragile. Grouping entitlements into profiles is one way to reduce that sprawl, provided the groups are designed around real work patterns.
• Dormant Identity: A non-human identity that is no longer actively used but still has valid access. Dormancy is risky because it looks harmless while preserving credentials, permissions, and trust relationships that can still be abused or accidentally triggered.
• Relationship governance: Relationship governance is the practice of controlling access based on how identities, resources, and permissions are connected rather than looking at accounts in isolation. It matters because modern environments distribute privilege across direct grants, inherited roles, and delegated machine workflows that simple account reviews often miss.

What's in the full article

Veza's full update covers the operational detail this post intentionally leaves for the source:

• Product-level context on the April 2026 updates and how the control plane is positioned in the broader platform narrative.
• Additional explanation of the enterprise agent identity control plane concept and how Veza connects it to access graph analysis.
• Report framing around the 2026 State of Identity and Access findings, including how the vendor interprets entitlement sprawl and dormant accounts.
• Broader product-update context from March and February 2026 that is not analysed here.

👉 Veza's full update includes the surrounding product context and report references behind the control-plane framing.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.