Topic starter
25/06/2026 2:55 pm
Autonomous agents invalidate the assumption that identity is a stable object. The article shows that agentic AI can decide, act, and continue across systems without a human pacing each step. That means the governance question is no longer who owns the account, but whether the account model can keep pace with a subject whose behaviour changes at runtime. Practitioners need to treat identity as an operating condition, not a fixed label.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between agentic AI security and traditional NHI security?
A: Traditional NHI security focuses on controlling a non-human identity that executes within more predictable bounds. Agentic AI security must also govern runtime choice, tool selection, and timing, because the identity can alter its own execution path while the task is still in progress.
👉 Read our full editorial: Agentic AI security needs identity controls, not just automation
25/06/2026 4:09 pm
Identity governance for agentic AI is really governance over delegated action, not just delegated access. The article shows that the valuable thing is no longer the response but the execution path, and that path can touch APIs, databases, and orchestration layers. That means access governance has to account for actions that complete without a human review cycle. Practitioner conclusion: control the action chain, not only the account.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between an AI agent identity and a service account?
A: A service account usually represents a fixed application or workload. An AI agent identity represents a system that can change paths, choose tools, and take different actions within the same session. That makes the agent more dynamic and harder to govern, so access must be evaluated continuously instead of assumed from a static role assignment.
👉 Read our full editorial: Agentic AI turns identity control into the new security boundary