Topic starter
06/07/2026 9:47 am
TL;DR: As AI agents move from recommendations to action, identity governance has to account for software that can plan, call tools, and complete workflows end to end, according to Lumos. The old model of manual access review cannot keep pace with autonomous decision loops, especially when human, machine, and agent identities now overlap.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “When Software Grows Hands”.
By the numbers:
- More than 70% of breaches use identity techniques.
Key questions
Q: How should security teams govern agent workflows at runtime?
A: Security teams should govern agent workflows with controls that evaluate prompts, tool calls, and outputs during execution, not only after deployment.
Q: Why do traditional access reviews fail for agentic enterprise identity?
A: Access reviews assume permissions remain stable long enough to be sampled and certified later.
Q: What breaks when RBAC is used for autonomous software?
A: Static roles become too slow and too coarse when software adapts its path at runtime.
Practitioner guidance
- Define task-scoped agent permissions Map each agentic workflow to the smallest viable action set, including tool use, data access, and approval boundaries.
- Move governance checks to issuance time Add policy checks before an agent receives access, and require runtime evidence for any action that crosses a sensitive boundary.
- Split RBAC for humans from policy for agents Keep role design for people, but govern agents through scoped objectives, allowed tools, and explicit revocation conditions.
Bottom line: Agentic software turns identity governance into a runtime control problem because access can be consumed before traditional review cycles see it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:04 am
Agentic identity governance is an access-control problem, not an AI feature problem: the control objective changes when software can finish work instead of merely recommending actions. Identity teams are no longer governing static entitlements alone; they are governing runtime authority across humans, services, and agents. That means access policy has to be expressed in terms of task boundaries, evidence, and revocation logic, not only role catalogs. Practitioners should treat agentic identity as a governance model shift, not a new checkbox in IAM.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
A question worth separating out:
Q: How do human IAM, NHI governance, and agent identity differ in practice?
A: Human IAM focuses on user authentication and role assignment, NHI governance focuses on service credentials and lifecycle control, and agent identity adds runtime decision-making that can change how access is consumed. A mature programme has to govern all three without treating them as the same identity type.
👉 Read our full editorial: Agentic identity governance is reshaping enterprise access control