Topic starter
19/08/2026 3:58 pm
TL;DR: Agentic AI systems are forcing identity teams to confront an architecture problem rather than a login problem, because continuous authentication, machine-speed authorization, and massive identity counts break centralized, stateful IAM patterns, according to Ory. The buffering-wheel analogy is apt: if identity cannot operate as a distributed control plane, security teams will keep trading scale for control and calling it governance.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “From Buffering Wheels to Billions of Streams: What Agentic AI Teaches Us About Scaling Identity”.
By the numbers:
- 61% report that their current IAM solutions are not ready for AI Agents from resilency perspective.
- 49% state that their current IAM solutions are not ready for AI agents from a compliance perspective.
- 62% report that their current IAM solutions are not ready for AI agents from a scale perspective.
Key questions
A: Static credentials create durable access that is hard to control in automated environments.
Q: Why do autonomous agents break traditional IAM assumptions?
A: Autonomous agents break traditional IAM assumptions because they do not wait for human review cycles, and they may select actions and tools at runtime.
Q: How do security teams know whether managed identities are working for agents?
A: Managed identities are working when there are no embedded secrets in code or config, each agent has a distinct identity, and privileges map cleanly to a small number of functions.
Practitioner guidance
- Redesign identity as a distributed control plane Shift agent authentication and authorization away from a single central service and toward local, policy-driven verification that can operate close to workloads without repeated round trips.
- Replace persistent trust with short-lived verification Use short-lived, cryptographically verifiable tokens for agent activity and reduce dependence on sessions that stay valid long enough to accumulate unnecessary exposure.
- Externalize authorization policy Keep permission logic out of application code and ad hoc scripts so the same decision rules apply consistently across services, environments, and agent workflows.
Bottom line: Agentic AI exposes a structural mismatch between human-era IAM and machine-speed identity activity, especially when systems depend on centralized, stateful decision points.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:35 pm
Identity architecture for agentic AI is now a control-plane problem, not a login problem. The article is right to frame agentic systems as a scaling event that invalidates assumptions built around occasional human authentication. Once actors authenticate continuously and act at machine speed, the question is no longer who logged in, but whether identity decisions can be delivered as infrastructure. Practitioners should stop treating this as an edge case and treat it as the next core identity architecture requirement.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when agent authentication starts becoming a bottleneck?
A: The answer is to move decision-making out of the bottleneck, not to stretch the old one further. That means externalizing authorization, reducing dependency on persistent state, and redesigning trust around short-lived verification so the identity layer can scale with the workload instead of blocking it.
👉 Read our full editorial: Agentic AI exposes the limits of human-era identity architecture