Topic starter
22/06/2026 4:55 pm
TL;DR: Agentic identity spans three distinct layers, discovery and posture, directory and lifecycle governance, and per-action proof, and no single product covers all of them, according to Scramble ID. The governance assumption that one control plane can both authorise and evidence autonomous actions is already breaking down as agent estates grow.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “The Agentic Identity Stack: Where Okta, Microsoft Entra, Astrix, Oasis, and ScrambleID Fit Together”.
By the numbers:
- With Gartner expecting 40% of enterprise applications to ship task-specific AI agents by the end of 2026, most enterprises will need more than one layer of agentic identity control.
Key questions
Q: What breaks when agentic identity is treated as one control plane?
A: Teams lose the ability to separate inventory, governance, and evidence.
Q: Why are AI discovery tools not enough for agent governance?
A: Because discovery tells you what exists and how risky it looks, but it does not remove the credential that makes the action possible.
Q: When should teams prioritise per-action proof over broader inventory work?
A: Prioritise proof when agents can approve, pay, file, or delete, because those actions create liabilities that need defensible evidence.
Practitioner guidance
- Define the agentic identity stack by control function Separate discovery, lifecycle governance, and per-action proof in your programme design so each layer has one accountable owner and one clear job.
- Map shadow-agent discovery into your lifecycle workflow Route discovered agents, MCP servers, and unregistered identities into onboarding, ownership assignment, scoping, and deprovisioning decisions rather than leaving them as inventory findings.
- Require request-level evidence for consequential actions For approvals, payments, deletions, and filings, retain a cryptographic record that ties the agent, the authority, and the action together so the audit trail survives dispute.
Bottom line: Agentic identity is emerging as a layered governance problem, not a single-platform purchase decision.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 5:05 pm
Agentic identity governance fails when organisations assume one control plane can cover discovery, lifecycle, and evidence. Those are separate obligations with different owners and different control goals. Discovery finds the estate, lifecycle governs the estate, and proof substantiates the estate’s actions. Practitioners should stop collapsing these into a single procurement question and treat them as distinct layers of control.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should IAM teams divide responsibility for agentic identity controls?
A: Split responsibility by layer. One team can own discovery and posture, another can own directory and lifecycle governance, and a third can own cryptographic proof and audit verification. That structure prevents the common mistake of expecting one control to answer every identity question.
👉 Read our full editorial: Agentic identity is a three-layer stack, not one product