Topic starter
08/01/2026 6:50 pm
TL;DR: AI agents are moving from feature to actor inside business applications, and Delinea argues that access governance must expand to treat them as governed identities, while many organisations still run access reviews and segregation of duties manually. The assumption that identity can be reviewed after the fact is breaking as agents take actions at runtime and often with elevated access.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “2026 Application Access Governance predictions: Securing AI agents and modernizing controls”.
By the numbers:
- Today, non-human identities account for about 60% of identities in a typical organization.
Key questions
Q: What breaks when AI agents are given broad enterprise access without tight governance?
A: Broad access turns AI agents into high-speed execution paths that can move data, spend money, modify records, or delete assets before operators can intervene.
Q: Why do AI agents increase risk in ERP and finance systems?
A: They increase risk because they can touch high-value records, make decisions from context, and operate with access that is often broader than a person would need.
Q: How can teams tell whether application access governance is keeping up with agents?
A: A useful signal is whether every agent has explicit ownership, a defined permission scope, and an automated review path.
Practitioner guidance
- Map every in-application AI agent Inventory where agents reside across business applications, identity providers, and security tooling so no agent remains invisible to governance workflows.
- Classify agents as governed identities Treat each agent like a privileged user in the access model, with explicit ownership, scope, and review cadence instead of assuming it inherits a human user role.
- Constrain permissions to task scope Limit each agent to the narrowest permissions needed for the specific business workflow it performs, especially in ERP, CRM, and HCM environments.
Bottom line: AI agents are changing application access governance by acting inside business applications, not just supporting users from the side.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 3:01 am
Access governance must expand from user-centric review to actor-centric governance: business applications are no longer only serving people, because AI agents can now initiate actions inside the application boundary. That means the governance subject is shifting from the human account alone to the combined human-plus-agent execution model. The implication is that application access governance programmes need to treat agents as first-class identities, not as workflow decorations.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI agents like human users in IAM?
A: No. Human IAM assumes a person logs in, works within a session, and can be reviewed later as a stable identity holder. Agents can act at machine speed, across multiple systems, and with changing runtime context, so they need identity governance built around execution and delegation rather than human authentication patterns.
👉 Read our full editorial: AI agents are forcing application access governance to expand in 2026