Topic starter
24/06/2026 10:31 pm
TL;DR: Legacy identity governance struggles when AI agents, machine identities, and cloud access change faster than periodic review cycles can see, according to SailPoint. Continuous governance, JIT access, and automated privilege discovery now define the practical baseline for teams trying to control non-human identity risk.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The next chapter of adaptive identity: From vision to market-leading reality”.
Key questions
Q: What breaks when organisations rely only on periodic access reviews?
A: Periodic reviews miss access that changes between certification windows, which leaves risk hidden until after the fact.
Q: Why do standing privileges make machine identities harder to secure?
A: Standing privileges extend the period in which a compromised secret can be abused, which enlarges the blast radius of a single exposure.
Q: How can security teams tell whether adaptive identity is actually working?
A: Look for shorter privilege duration, fewer standing entitlements, faster discovery of privileged paths, and reduced dependence on quarterly certification as the primary control.
Practitioner guidance
- Define continuous governance thresholds Move high-risk AI agents and machine accounts out of periodic review queues and into continuously monitored governance thresholds based on privilege, environment, and task context.
- Enforce JIT for non-human access Replace standing access with task-scoped entitlement issuance for non-human identities, including automatic expiry and explicit re-approval for reuse.
- Classify indirect privilege paths Use identity graph analysis to identify hidden entitlement chains, inherited access, and over-privileged pathways that are not visible in direct assignment lists.
Bottom line: Legacy governance is out of step with the pace of AI agents and machine identities, which can change faster than periodic review cycles can observe.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:14 am
Continuous governance is becoming the baseline for non-human identity control. Periodic access review was designed for slower, human-paced identity change, not for machine identities and AI agents that can be created and retired within minutes. That assumption is breaking in cloud-first environments where privilege can be granted and used before a review cycle even begins. The implication is that governance must move closer to issuance time and runtime state, not rely on retrospective certification.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI SOC agents like governed identities?
A: Yes, because the practical risk is delegated access, not just model output. If an AI agent can read evidence, prepare actions, or trigger connected tools, it needs scoped permissions, defined task boundaries, and revocation when the workflow ends. That is the identity control model SOC teams already use for other non-human actors.
👉 Read our full editorial: Adaptive identity and AI agents are reshaping identity governance