Topic starter
25/06/2026 1:09 am
TL;DR: AI agents are already powering hundreds of workflows and are expected to outnumber humans 80:1 in large enterprises, but most still operate without identity guardrails, according to Strata Identity. Traditional IAM assumptions break when identity, access, and audit must move at machine speed, not human pace.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “The future of identity is agentic”.
By the numbers:
- Large enterprises are expected to manage 80:1 more agents than humans in the next few years.
Key questions
Q: What breaks when AI agents are managed like ordinary machine identities?
A: What breaks is the assumption that access scope can be fully understood from provisioning data and quarterly review.
Q: Why do autonomous coding agents create new governance risks for identity teams?
A: Because they behave like non-human workloads with delegated access, reusable context, and tool permissions that can outlive a single task.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Inventory every production agent identity Catalogue the agents already embedded in refunds, IT automation, and cross-cloud workflows, then record what each one can access and on whose behalf it acts.
- Move authorisation into the execution path Apply policy checks at task start and during delegated action, not only at provisioning or recertification time, so agent decisions are governed while they happen.
- Require traceable on-behalf-of delegation Log the initiating principal, delegated identity, tool use, and action sequence for every agent session so audit can reconstruct what the agent actually did.
Bottom line: Agentic AI introduces a governance problem that traditional IAM was not designed to handle because agent decisions happen at machine speed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:22 am
Machine-speed identity governance is now a control-plane problem, not a policy-document problem. The article shows that agentic systems already operate inside production workflows, which means governance has to be enforced where execution happens. Static IAM controls cannot keep pace with agents that initiate action, select tools, and complete tasks in the same runtime window. Practitioners should treat agent identity as an operational control plane, not a future-state architecture exercise.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between an AI agent and a normal service account?
A: A normal service account authenticates and executes fixed instructions. An AI agent adds reasoning and can choose actions based on model output, which makes its effective behaviour dynamic. That difference matters because the risk is not only access, but decision-making combined with access. Governance must account for both authority and autonomy.
👉 Read our full editorial: Agentic AI identity governance needs machine-speed control models