Notifications
Clear all
Topic starter
03/06/2026 2:23 pm
TL;DR: Agentic AI pushes business logic from static applications into runtime decision-making, which in turn breaks identity governance and segregation-of-duties models built on periodic enforcement, according to Saviynt. The governance failure is not just slower tooling, but an assumption that access can be reviewed after the fact when decisions are now made in context and at execution time.
NHIMG editorial — based on content published by Saviynt: The Intelligence as a Service Era: How Agentic AI Reshapes Enterprise Software
By the numbers:
- Only 34% of organizations are truly reimagining their businesses around AI.
- The 2026 State of AI report found that only 34% of organizations are truly reimagining their businesses around AI.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams govern agentic AI beyond traditional IAM controls?
A: Security teams should govern agentic AI at the point of execution, not only at the point of access assignment.
Q: Why do agentic AI systems break segregation of duties models?
A: They break SoD models because the conflict can be created and consumed inside one runtime sequence.
Q: How do you know if runtime governance for AI is actually working?
A: Look for whether decisions are captured with context, whether exceptions are traceable to a named owner, and whether blocked actions are prevented before execution completes.
Practitioner guidance
- Map runtime decision points Identify where agentic systems make choices, invoke tools, or escalate actions during execution.
- Rework segregation of duties for action sequences Review SoD rules for conflicts that appear across multi-step workflows, especially where an agent can assemble a complete business process without human interruption.
- Align IGA with execution telemetry Feed approval, exception, and context data into identity governance so certification is informed by what the system actually did at runtime.
What's in the full article
Saviynt's full blog post covers the operational detail this post intentionally leaves for the source:
- How the article frames the move from human-mediated workflows to outcome-based execution across enterprise software
- The specific identity governance and segregation-of-duties example used to illustrate runtime control failure
- The role descriptions that may change as AI takes over more of the decision logic inside business applications
- The additional quotes and references the author uses to support the shift from application-centric to agent-centric software
👉 Read Saviynt's analysis of how agentic AI reshapes enterprise software →
Agentic AI and enterprise software: what changes for identity governance?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
03/06/2026 2:31 pm
Runtime governance gap: the core problem is not that AI makes enterprise software faster, but that identity governance was built for deferred enforcement. Access review, segregation of duties, and exception handling all assume that the relevant state exists long enough to be observed and certified. When logic moves to runtime, the control plane must see decisions as they are made. Practitioners should treat this as a governance architecture mismatch, not a policy tuning issue.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between agentic AI governance and traditional workflow automation?
A: Traditional workflow automation follows predefined rules and fixed paths, while agentic AI makes runtime decisions based on context and may change the path as it executes. Governance therefore shifts from validating a scripted process to constraining live decision-making, which requires stronger identity, policy, and telemetry integration.
👉 Read our full editorial: Agentic AI shifts enterprise software logic to runtime, not rules
