Topic starter
12/07/2026 12:25 pm
TL;DR: Autonomous AI agents are already booking, buying, deploying and signing on behalf of organisations, and the article argues that human IAM models cannot safely govern that behaviour because delegation, context-driven action and machine-scale execution break the old authority model. Identity scope, delegation chains and auditability become the core controls, according to eMudhra.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Why AI Agents Need Their Own Identities — Agentic Identity 2026”.
Key questions
Q: What breaks when autonomous agents are governed like human users?
A: Session-based IAM breaks first, because autonomous agents can make and execute decisions between review points.
Q: Why do autonomous agents create new IAM accountability problems?
A: Autonomous agents can choose actions, tools, and timing at runtime, so accountability can no longer rely on static job roles or human approval alone.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Define agent-specific identity boundaries Create a separate policy model for agents that distinguishes them from human users and from non-autonomous workloads, including who sponsors each agent and what business task it is permitted to perform.
- Scope credentials to one task and one timeframe Issue machine-readable, short-lived credentials for a single business outcome such as a purchase order, deployment or service ticket closure, then revoke them automatically when the task ends.
- Preserve delegation lineage end to end Record the human or organisational sponsor, any intermediate delegation steps and the downstream systems involved so the authority chain remains explainable after the action completes.
Bottom line: Autonomous agents do not fit cleanly into human IAM because they can vary actions with context and execute at machine speed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:38 pm
Agentic identity is not a variant of human IAM; it is a separate control domain. Human identity assumes a stable person behind the session, while agentic systems may choose actions dynamically and execute them at machine speed. That breaks the original authority model rather than merely stressing it. The implication is that IAM programmes must stop treating agent permissions as a special case of user access and begin governing them as a distinct identity class.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations centralise agent, human and workload identity governance?
A: Yes, but not by collapsing the three into one type of account. The policy engine should be shared, while the identity semantics remain distinct. That lets teams apply consistent governance over authorisation, audit and revocation without pretending that a person, a service account and an autonomous agent behave the same way.
👉 Read our full editorial: Agentic identity governance is now a third IAM domain