Notifications
Clear all
Topic starter
12/07/2026 12:25 pm
TL;DR: Autonomous AI agents are already booking, buying, deploying and signing on behalf of organisations, and the article argues that human IAM models cannot safely govern that behaviour because delegation, context-driven action and machine-scale execution break the old authority model. Identity scope, delegation chains and auditability become the core controls, according to eMudhra.
NHIMG editorial — based on content published by eMudhra: autonomous AI agents and the case for agentic identity governance
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do existing IAM controls struggle with autonomous AI agents?
A: Existing IAM controls were designed around human users and predictable workload behaviour.
Q: What breaks when AI agent access is broader than the task it is trying to complete?
A: When agent access is broader than the task, the identity can touch systems, data, and tools that were never necessary for the work.
Practitioner guidance
- Define delegated authority per agent task Create identity records that bind each agent to a single initiating principal, a bounded business purpose and a specific expiry condition.
- Replace static tokens with task-scoped credentials Issue machine-readable scopes that limit systems, actions and duration for every agent session.
- Log delegation lineage end to end Capture the initiating human or organisation, each downstream service call, the tools used and the resulting action outcome.
What's in the full article
eMudhra's full article covers the operational detail this post intentionally leaves for the source:
- A closer look at the SecurePass agentic identity governance model and how it maps to workforce, customer and machine identity.
- The article's regulatory framing across the EU AI Act, NIST AI Risk Management Framework and India's DPDP Act.
- A discussion of scoped credentials, delegation chains and auditability in one identity platform.
- Additional context on how the vendor positions agentic identity alongside Zero Trust identity and IAM.
👉 Read eMudhra's analysis of agentic identity governance and AI agent controls →
Agentic identity governance: what IAM teams need to rethink now?
Explore further
12/07/2026 12:38 pm
Agentic identity governance is a third identity domain, not a subcase of human IAM. Human authentication models assume a person is present at login and remains the accountable operator for the session. AI agents can act for someone else, adjust behaviour in context and complete outcomes at machine speed, so the governance unit has to be the delegated actor itself. The implication is that identity architecture must stop treating agent actions as merely automated user activity.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent makes a risky decision?
A: Accountability should rest with the organisation that authorised the agent, the human owner of the workflow, and the control process that allowed the behaviour. If an agent can act independently, the programme must preserve attribution, action logs, and policy decisions so audit and remediation are possible after the event.
👉 Read our full editorial: Agentic identity governance is now a third IAM domain
