Topic starter
24/10/2026 8:47 pm
TL;DR: AI agents are exposing a gap in identity programmes built for people, not actors with independent judgment and machine-speed execution, according to Newcore. IAM now has to show ownership, delegation lineage and action-level control across both humans and agents.
Editorial analysis by NHI Mgmt Group, based on content published by Newcore: ““It’s Not Me, It’s My Agent”: Governance and Accountability in the Age of AI Agents”.
Key questions
Q: Why do AI agents create accountability problems for IAM and NHI teams?
A: AI agents create accountability problems because traditional IAM proves who authenticated, while agent governance must prove what the actor did with that access.
Q: How do organisations decide whether an AI agent should be allowed to act autonomously?
A: Autonomy should be granted only when the business process can tolerate runtime action, the owner is clear, the policy engine can make immediate decisions, and the activity is fully attributable.
Q: What breaks when AI agents are reviewed like human users?
A: Human review assumes access is stable long enough to be observed, approved, and recertified.
Practitioner guidance
- Inventory agents as first-class identities Discover agents across platforms, assign each one a unique owner and keep that owner current through role changes and offboarding.
- Derive agent authority from the human owner Ensure an agent cannot exceed the access of the person it represents, and transfer ownership rather than orphaning the agent when staff move or leave.
- Govern actions instead of applications Define which actions are allowed, which require human approval and which are denied outright, especially for bulk updates, exports and irreversible changes.
Bottom line: AI agents are exposing a gap in identity programmes that were designed for people, not for actors with independent judgment and machine-speed execution.
Glossary terms: Agent Accountability, Delegation Chain, Sequence-Level Authorisation, Effective Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Agent identity is now a governance class of its own: the article shows why agents cannot be treated as ordinary application extensions or service accounts. They have independent judgment, can persist beyond their creators and may accumulate authority through delegation chains. The operational consequence is that identity programmes must govern the agent as the accountable subject, not merely the app it touches.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should security teams do about delegated access across sub-agents?
A: Security teams should require revalidation at each hop in the delegation chain. Every downstream agent should carry the current identity, current context, and the original intent so inherited access does not turn into a blanket pass.
👉 Read our full editorial: AI agent accountability needs ownership and action-level control
This post was modified 7 days ago by NHI Mgmt Group