Topic starter
22/06/2026 3:42 pm
TL;DR: AI-driven conversational interfaces, autonomous agents, and natural-language policy design could reshape IAM workflows, from onboarding to access recertification, according to EmpowerID's interview with Patrick Parker at EIC 2024. Access governance assumes human-paced review loops; autonomous execution collapses that assumption, so identity teams must rethink how authority is granted and observed.
Editorial analysis by NHI Mgmt Group, based on content published by EmpowerID: “The AI Revolution in Identity: Insights from Patrick Parker at EIC 2024”.
Key questions
Q: What breaks in IAM when AI agents can plan and execute tasks at runtime?
A: IAM controls built around static entitlements and human-paced approvals start to fail when an agent can choose tools, order actions, and complete work inside one task flow.
Q: Why do autonomous agents change the access control model so much?
A: Because they do not wait for human review and do not behave like static accounts.
Q: What are the signs that policy as natural language is creating governance risk?
A: Warning signs include policies that are easy to write but hard to test, contradictory interpretation between business users and administrators, and access rules that expand beyond the original intent after translation.
Practitioner guidance
- Re-map approval boundaries Identify where current approval gates assume a human is present to review or approve the next step, then mark the places where an agent can complete the action chain without that pause.
- Separate policy authoring from enforcement Keep natural-language policy creation under controlled review and validate that the translated rule matches the intended scope before it governs access decisions.
- Define agent identity lifecycle ownership Assign clear ownership for onboarding, monitoring, policy change, and offboarding of AI agents so they are governed like first-class identities rather than ad hoc automations.
Bottom line: AI agents turn IAM from a static access model into a runtime governance problem because tool choice and action sequencing can now happen inside the task itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 3:47 pm
Access review processes were designed for access that persists long enough to be reviewed. That assumption fails when AI agents can request, combine, and release privileges within a single runtime sequence. The implication is not simply more review, but a shift in where governance must attach to the identity lifecycle.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Who should own onboarding performance in an IAM programme?
A: Onboarding performance should be shared across IAM, HR, application owners, and business process owners because the delay usually sits at the joins between systems. If only the IAM team owns it, the programme misses upstream role design and downstream application readiness. Governance works when ownership matches the end-to-end lifecycle.
👉 Read our full editorial: AI agents are reshaping IAM governance and access control