Notifications
Clear all
Topic starter
19/08/2026 3:45 pm
TL;DR: The post sits inside an agentic identity theme but provides no substantive technical or quantitative detail beyond announcing its Agentic Identity Hub focus, according to Descope. For IAM and NHI practitioners, the relevant question is how identity controls adapt when AI-driven systems become first-class actors that need governed access, lifecycle, and accountability.
NHIMG editorial — based on content published by Descope: Meet a Descoper: Developer Chat With Tomer Lichtash
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: What breaks when agentic systems inherit broad application credentials?
A: Broad credentials create a runtime delegation gap because the system can use the same access for multiple actions that were never individually approved.
Q: Why do traditional IAM controls struggle with agentic identity?
A: Traditional IAM assumes access can be reviewed and governed as a stable entitlement.
Practitioner guidance
- Define agentic identity boundaries Inventory which systems can select actions or tools at runtime, then classify them separately from fixed automation and ordinary workloads.
- Extend lifecycle controls to runtime actors Add offboarding, review, and access expiry rules for delegated systems that may outlive a task, prompt, or session.
- Require execution traceability Capture which tools were called, which resources were touched, and which decisions were made after authentication.
What's in the full article
Descope's full blog post covers the product and category context this post intentionally leaves for the source:
- Product framing for the Agentic Identity Hub and how Descope positions the category.
- Any implementation details or workflow examples that show how the hub is expected to fit into identity programmes.
- Vendor-specific context around the launch theme that was not needed for this independent analysis.
- The source article's broader marketing narrative around agentic identity as a product category.
👉 Read Descope's blog on agentic identity and the Agentic Identity Hub →
Agentic identity governance: what changes for IAM teams now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
19/08/2026 4:22 pm
Agentic identity is now a governance category, not just a product label. The industry is moving toward systems that act with delegated authority, which means IAM teams must distinguish between ordinary automation and actors that can make runtime decisions. Once an identity can choose actions at execution time, the control problem shifts from provisioning access to governing behaviour. Practitioners should treat this as a new identity class with its own lifecycle and accountability model.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, which widens the trust boundary before agentic controls are even considered.
A question worth separating out:
Q: How do teams know if agent access is staying inside its intended scope?
A: Measure execution-level evidence, not just identity events. Look for tool calls, resource access, action sequences, and revocation behaviour tied to a specific task. If the only evidence is authentication and token issuance, you do not have enough signal to judge scope adherence.
👉 Read our full editorial: Descope and agentic identity governance: what practitioners need to know
