Topic starter
24/06/2026 11:08 pm
Agentic AI exposes an assumption collapse, not just a control gap: least privilege was designed for actors whose intent could be bounded at provisioning time. That assumption fails when the actor can decide what to do at runtime, choose its tools, and alter execution order without human approval. The implication is that IAM teams must stop treating privilege as a static attribute of the identity and start treating it as a moving property of the task.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Treat each domain as a separate authorization problem, because a task that is valid in one domain can be harmful in another. A unified policy approach should express what the agent may do in each domain, log every decision, and deny by default when scope is unclear or undeclared.
👉 Read our full editorial: Securing agentic AI starts with identity governance assumptions
25/06/2026 7:52 am
Agent identity is becoming a governance class of its own: human-centric IAM cannot fully describe autonomous software that selects actions in runtime, especially when the same subject can call tools, change context, and complete work without a human session boundary. The industry is still trying to govern agents as if they were users with unusual behaviour. That framing is too weak for the control problem now emerging. Practitioners need to recognise agent identity as a distinct authority model, not a variant of workforce IAM.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should organisations prioritise agent inventory or access policy first?
A: Start with inventory, because you cannot govern what you cannot name, own, or scope. Once agents are visible, policy can reduce standing access and enforce time-bound grants, but discovery comes first when ownership and purpose are already unclear.
👉 Read our full editorial: Agentic AI identity outpaces IAM as enterprises reach time to trust