Topic starter
12/06/2026 12:15 am
TL;DR: Deloitte’s 2025 Technology Predictions report says 50% of generative-AI companies will deploy agentic solutions by 2027, while AuthMind argues that traditional IAM and IGA tools cannot see, classify, or govern these autonomous identities well enough to control access, audit behaviour, or contain shadow usage. That makes identity observability a governance requirement, not an optional add-on.
Editorial analysis by NHI Mgmt Group, based on content published by AuthMind: “Agentic AI Protection Starts with Identity Observability”.
By the numbers:
- 50% of companies using generative AI will deploy agentic solutions by 2027, according to Deloitte’s 2025 Technology Predictions report cited by AuthMind.
- Agentic solutions will be deployed by 2027, according to Deloitte’s 2025 Technology Predictions report cited by AuthMind.
Key questions
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
Q: Why are shadow AI agents a risk for enterprises?
A: Shadow AI agents operate without formal governance or oversight, posing risks of unauthorized access and data breaches.
Q: How do security teams know whether an AI agent is operating safely?
A: Security teams know an AI agent is operating safely when its permissions, invoked tools, and accessed data remain consistent with the approved use case over time.
Practitioner guidance
- Define a runtime identity inventory Track approved agents, unmanaged agents, and personal identities in one inventory so governance starts with complete identity visibility.
- Correlate agent activity to a named identity Require every AI-driven action to map back to the human, NHI, or agent identity that initiated it so audit trails are usable.
- Separate sanctioned AI use from shadow use Establish policy boundaries that distinguish corporate identities and tools from personal accounts used to reach AI systems.
Bottom line: Agentic AI introduces autonomous identities that can act with privilege, which leaves traditional IAM and IGA controls blind to runtime behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:22 am
Identity observability is becoming a baseline control for agentic AI, not a reporting layer. Traditional IAM and IGA assume the identity can be enumerated and governed before it acts. Agentic systems break that assumption because the meaningful control point moves into runtime behaviour, where discovery and correlation matter more than static entitlements. Practitioners should treat observability as the mechanism that makes governance possible at all.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should IAM teams treat GenAI as part of access governance?
A: Yes. GenAI is part of access governance whenever it can read, transform, or disclose enterprise data, because the key question is who or what is authorised to invoke the model and under what conditions. IAM teams should define identity ownership, access scope, logging, and review for each GenAI workflow before adoption scales.
👉 Read our full editorial: Identity observability for agentic AI is now an IAM gap
This post was modified 1 day ago by NHI Mgmt Group