Topic starter
12/06/2026 12:08 am
TL;DR: Governance is lagging while AI adoption accelerates, according to 1Password’s Black Hat panel summary, with panelists arguing that zero trust, least privilege, just-in-time access, and revocability must be extended to AI agents and shadow AI environments. The central issue is not AI hype but the collapse of human-bound identity assumptions that existing controls were built around.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “AI and security at Black Hat: 5 key takeaways from a security expert panel”.
By the numbers:
- 1Password says 54% of security leaders admit their governance enforcement is weak.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Practitioner guidance
- Inventory AI agents and shadow AI Create a live register of AI tools, agents, owners, data access, and business purpose.
- Apply task-scoped access by default Replace standing access with task-scoped entitlements for AI agents, so each request is tied to a bounded use case and expires when the task ends.
- Add revocation triggers for agent misuse Define explicit conditions that force access removal when an AI agent drifts from approved behaviour, reaches a workflow boundary, or becomes unowned.
Bottom line: The article’s core warning is that AI adoption is outpacing the governance model that was built for human identity, leaving zero trust controls mismatched to the subject being governed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:11 am
Zero trust now has to account for a non-human trust subject: the model was built around validating people, devices, and sessions, but AI agents change the unit of trust. That means the access decision is no longer anchored to a human operator with stable behavioural signals. Practitioners need to treat the AI agent itself as the governed identity subject, not a tool hidden behind the user.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between zero trust and zero standing privilege for AI agents?
A: Zero Trust Architecture assumes every request must be verified, while zero standing privilege removes persistent access entirely and provisions rights only when needed. For AI agents, the two work together: zero trust limits what the agent can reach, and zero standing privilege limits how long it can keep that reach.
👉 Read our full editorial: AI agent governance needs a zero trust upgrade for enterprise identity
This post was modified 1 day ago by NHI Mgmt Group