Notifications
Clear all
Topic starter
19/08/2026 3:58 pm
TL;DR: Agentic AI systems are forcing identity teams to confront an architecture problem rather than a login problem, because continuous authentication, machine-speed authorization, and massive identity counts break centralized, stateful IAM patterns, according to Ory. The buffering-wheel analogy is apt: if identity cannot operate as a distributed control plane, security teams will keep trading scale for control and calling it governance.
NHIMG editorial — based on content published by Ory: From Buffering Wheels to Billions of Streams: What Agentic AI Teaches Us About Scaling Identity
By the numbers:
- 62% report that their current IAM solutions are not ready for AI agents from a scale perspective.
- 61% report that their current IAM solutions are not ready for AI Agents from resilency perspective.
- 59% state that their current IAM solution are not ready for AI agents from a security perspective.
Questions worth separating out
Q: How should security teams govern machine identity credentials in agentic AI environments?
A: Security teams should extend secrets scanning to cover MCP configuration files, enforce short-lived credentials for all agent workloads, and assign clear ownership to every non-human identity regardless of its origin , human-created or AI-generated.
Q: Why do traditional IAM controls struggle with autonomous AI agents?
A: Traditional IAM assumes predictable users or static machine accounts, but AI agents can act independently, interact with multiple systems, and generate new access needs over time.
Q: What breaks when identity systems stay stateful in agent environments?
A: Stateful identity creates pressure to retain sessions, reuse tokens, and centralise decisions.
Practitioner guidance
- Redesign identity as a distributed control plane Map where your current IAM stack still depends on centralised, synchronous checks and remove those dependencies for high-frequency agent traffic.
- Replace long-lived trust with short-lived credentials Set explicit ceilings on token lifetime and validate that every credential used by an autonomous workload can be verified locally without shared session state.
- Externalise policy from application code Move authorisation logic out of app logic and into a consistent policy layer that can be reused across services, cloud environments, and agent workflows.
What's in the full article
Ory's full blog post covers the architectural detail this post intentionally leaves for the source:
- The streaming-era analogy expanded into a deeper design discussion on stateless delivery, edge distribution, and failure tolerance for identity systems.
- The post includes the survey figures behind agentic readiness, which are useful when you need to brief leadership on the scale of the gap.
- It also develops the argument for distributed control planes and cloud- and edge-native identity patterns in more detail than this analysis.
- The source article closes with implementation framing that links machine-first identity to broader platform strategy.
👉 Read Ory's analysis of agentic AI identity at scale →
Agentic AI identity at scale: are your controls built for billions?
Explore further
19/08/2026 4:35 pm
Agentic AI identity exposes an architecture failure, not a feature gap. The article is right to compare agentic identity with early streaming video because both problems were caused by systems that scaled the wrong assumptions. Human-era IAM treats identity as an occasional event. Autonomous actors turn identity into a continuous control plane, and that is why latency, state, and synchronous checks become the failure mode. The implication is that agent governance cannot be bolted onto human login architecture.
A few things that frame the scale:
- 62% report that their current IAM solutions are not ready for AI agents from a scale perspective, according to AI Agents: The New Attack Surface report.
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
A question worth separating out:
Q: Who should own governance when humans, services, and AI agents all access the same resources?
A: Ownership should sit with the identity and security functions that already govern access policy, logging, and lifecycle controls. The key is to maintain one control plane for identity decisions, even if multiple actor types use it. That avoids duplicated rules, inconsistent audit trails, and gaps between AI operations and existing IAM programmes.
👉 Read our full editorial: Agentic AI exposes the limits of human-era identity architecture
