Notifications
Clear all
Topic starter
26/08/2026 11:51 am
TL;DR: At RSAC 2026, a hard governance problem framed agentic AI security: how businesses prove a specific human approved a high-consequence action, while also extending passwordless and enrollment workflows for human identities, according to Yubico. The real issue is that accountability for AI-driven actions breaks when approval is not cryptographically bound to the actor and event.
NHIMG editorial — based on content published by Yubico: RSAC 2026 recap on agentic AI approval and passwordless identity
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should organisations prove that a human approved an AI agent’s high-risk action?
A: They should require proof-of-presence controls that bind the human approval to the exact action, actor, and time of execution.
Q: Why do AI agents complicate traditional IAM reviews?
A: Traditional IAM review assumes identities have human lifecycle events such as hire, role change, or offboarding.
Q: What breaks when passwordless identity is not linked to privileged approval?
A: Security teams can end up with strong login assurance but weak decision assurance.
Practitioner guidance
- Map approval-bound agentic workflows Identify every workflow where an AI system can initiate or continue a business action, then require a verifiable human approval step for the highest-risk cases.
- Bind proof-of-presence to privileged decisions Use hardware-backed authentication for operators who can authorise agent actions, and make the approval event cryptographically attributable to the exact request being approved.
- Review onboarding and recovery exceptions Examine where enrollment, replacement, or recovery processes create fallback paths that weaken assurance.
What's in the full article
Yubico's full article covers the operational detail this post intentionally leaves for the source:
- The exact RSA 2026 partnership and integration context behind the agentic AI approval work.
- The implementation detail behind hardware-backed proof-of-presence for human authorisation.
- The rollout specifics for passwordless adoption and YubiKey enrollment in Microsoft and PingID environments.
- The broader set of product milestones and alliance announcements referenced in the RSAC 2026 recap.
👉 Read Yubico's RSAC 2026 recap on agentic AI approval and passwordless identity →
AI agent approval and passwordless identity: are controls keeping up?
Explore further
26/08/2026 11:51 am
Proof-of-presence is becoming a control plane, not a login feature. The RSAC theme here is not just stronger authentication, but stronger accountability for delegated actions. Once AI agents can act in business workflows, organisations need evidence that a specific human approved a specific high-consequence step. That makes proof-of-presence a governance control for action authorization, not merely a user experience improvement.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Why NHI Security Matters Now.
A question worth separating out:
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review. That means tightly scoping tools, data, and actions; logging every material step; and making revocation and containment available while the session is still active. Static policy alone does not control machine-paced execution.
👉 Read our full editorial: Hardware-backed approval for AI agents exposes the accountability gap
