Topic starter
25/06/2026 2:51 pm
TL;DR: Agentic AI changes the trust model by making software a decision-maker that can select tools, act across systems, and create new identity and access risks, according to Keyfactor. Digital trust now depends on governing machine and agent identities, not just human authentication and certificate hygiene.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “How Agentic AI Redefines Digital Trust”.
Key questions
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review.
Q: Why do autonomous agents change identity governance more than chatbots do?
A: Because the risk moves from generated content to real access.
Q: What breaks when certificate hygiene is the only control for agentic AI?
A: Certificate hygiene proves credential validity, but it does not constrain what a validated agent may do.
Practitioner guidance
- Define agent identity boundaries Inventory every agentic system that can select tools or take actions without a human approval gate, then assign an explicit identity owner, permitted action scope, and revocation path.
- Separate authentication from authorisation Do not treat certificate possession or token validity as proof that an agent should be able to act broadly across systems.
- Model runtime authority drift Review where an agent's access can expand during task execution through delegated credentials, chained tools, or downstream API calls, and document those paths as governance risks.
Bottom line: Agentic AI turns software into an identity-governed actor, which means access policy has to follow runtime behaviour, not just login events.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:02 pm
Agentic AI creates an identity class that traditional machine governance cannot fully absorb: once software can decide what to do at runtime, it is no longer enough to treat it as a static workload or service account. The governance challenge shifts from provisioning an identity to constraining an actor that can change how it uses access while the task is still underway. That makes agentic AI a distinct governance problem, not an extension of ordinary automation.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do IAM teams decide whether an AI use case needs new controls or better NHI hygiene?
A: Start with the identity mechanics. If the use case depends on service principals, managed identities, access keys or delegated OAuth grants, it needs NHI governance first. If it also makes runtime decisions about actions and tool use without approval gates, then autonomous behaviour adds another layer of control analysis.
👉 Read our full editorial: How agentic AI redefines digital trust and identity governance