Topic starter
02/09/2026 3:57 pm
TL;DR: AI agents are becoming mainstream, with 73% of enterprises expected to adopt them by 2026, but autonomy creates a governance gap because continuous operation and multi-system access outstrip one-time authorisation models, according to SecureAuth. The practical issue is not just access control, but whether identity, policy, and blast-radius limits can keep pace with runtime decision-making.
Editorial analysis by NHI Mgmt Group, based on content published by SecureAuth: “Securing the Rise of Agentic AI”.
By the numbers:
- 73% of enterprises are expected to adopt AI agents by 2026, according to SecureAuth.
- 40% of organisations report AI security concerns, according to SecureAuth.
Key questions
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review.
Q: Why does continuous authorization matter more than one-time approval for agentic AI?
A: Because autonomous agents can change behaviour mid-session.
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Practitioner guidance
- Define a unique identity for every AI agent Assign each agent its own identity, scope and trust level so policy, logging and review attach to the actual actor, not a shared automation bucket.
- Shift authorization to runtime evaluation Check current policy, context and risk before each material action instead of relying on a single approval at task start.
- Contain each agent to a narrow blast radius Limit database, API and external service access to the minimum scope needed for the agent's defined role and keep high-risk actions isolated.
Bottom line: Agentic AI creates a governance problem because autonomous systems can continue making decisions after initial access is granted.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
02/09/2026 3:58 pm
Continuous authorization is the real control boundary for agentic AI. One-time sign-in checks were designed for actors whose intent stays stable across a session. That assumption fails when an agent can keep selecting actions as context changes, so governance has to be evaluated at each decision point. The implication is that runtime policy becomes the primary control surface, not initial authentication.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should identity teams change when autonomous systems enter IAM?
A: They should move from static entitlement thinking to behaviour-aware governance. That means unique identities for agents, runtime policy checks, tighter scoping and logging that follows the actor across every interaction. Human IAM patterns do not transfer cleanly when the subject can decide, act and continue without pause.
👉 Read our full editorial: Agentic AI security depends on continuous identity and authorization
This post was modified 1 day ago by NHI Mgmt Group