Topic starter
24/06/2026 11:08 pm
TL;DR: Agent identity governance is lagging human-centric IAM patterns, Strata Identity reports, as enterprises push AI agents toward autonomy. Runtime authorisation, traceability, and ownership need to be built into the control model before audit confidence can improve.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “New Survey from Cloud Security Alliance, Strata Identity Finds That Enterprises Are in a “Time-to-Trust” Phase, As They Build Foundations for AI Autonomy”.
By the numbers:
- 84% of organisations doubted they could pass a compliance audit focused on agent behaviour or access controls, according to Strata Identity.
- Only 18% of respondents said they are highly confident their current IAM systems can manage agent identities effectively, according to Strata Identity.
Key questions
Q: Why do static credentials create problems for agentic AI access control?
A: Static credentials assume authority changes slowly enough for human review and periodic rotation.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Q: What breaks when organisations try to retrofit IAM controls onto AI agents?
A: Retrofit IAM breaks when the control model assumes a stable human session or a single workload identity.
Practitioner guidance
- Define agent identity as a separate governed population Create a distinct inventory, approval model, and ownership chain for autonomous agents instead of folding them into workforce IAM records.
- Replace static access with runtime-scoped authorisation Reduce dependence on reusable API keys and passwords for agents, and require task-scoped access decisions tied to current context and intent.
- Build real-time agent inventory and traceability Track every deployed agent, its current privileges, and its actions across environments so audits and investigations can be completed from evidence, not inference.
Bottom line: Agentic AI identity is outpacing the IAM patterns most enterprises still rely on, especially where static credentials and human-centric controls are reused for software that behaves autonomously.
Glossary terms: AI Agent Identity Governance, Runtime Authorisation, Identity Blast Radius, AI Traceability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago 3 times by NHI Mgmt Group
25/06/2026 7:52 am
Agent identity is becoming a governance class of its own: human-centric IAM cannot fully describe autonomous software that selects actions in runtime, especially when the same subject can call tools, change context, and complete work without a human session boundary. The industry is still trying to govern agents as if they were users with unusual behaviour. That framing is too weak for the control problem now emerging. Practitioners need to recognise agent identity as a distinct authority model, not a variant of workforce IAM.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should organisations prioritise agent inventory or access policy first?
A: Start with inventory, because you cannot govern what you cannot name, own, or scope. Once agents are visible, policy can reduce standing access and enforce time-bound grants, but discovery comes first when ownership and purpose are already unclear.
👉 Read our full editorial: Agentic AI identity outpaces IAM as enterprises reach time to trust