Topic starter
06/07/2026 9:35 am
TL;DR: Enterprise adoption of AI agents is outpacing traditional identity models, with 57% of practitioners calling them NHIs and 43% treating them as a distinct identity type, according to Token Security and NHI Mgmt Group polling. The governance gap is structural because human-paced access review, ownership, and offboarding assumptions do not map cleanly to agent behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “How to Discover, Prioritize, and Safely Enable AI Agents”.
Key questions
Q: How should security teams classify AI agents in identity programmes?
A: Classify by behaviour first.
Q: Why do AI agent runtimes create more governance risk than ordinary service accounts?
A: AI agent runtimes can combine decision-making, tool use, and secret access in one execution path, so a single trust failure can cause data exposure and operational change.
Q: What are the signs that AI agent oversight is becoming too intrusive?
A: A common warning sign is when employees start avoiding sanctioned tools because they believe every prompt or workflow may be read.
Practitioner guidance
- Define AI agents as a separate identity class Create a formal classification that keeps AI agents distinct from both human users and conventional service accounts in IAM, IGA, and access review workflows.
- Map every agent to a named human owner Require ownership linkage for each agent so that every token, integration, and business use case has a responsible party for approval, review, and revocation.
- Scan for agent activity across discovery hotspots Search repositories, secrets vaults, managed AI service logs, and runtime telemetry for agent naming patterns, SDK imports, and API usage that do not appear in IAM reports.
Bottom line: AI agents are a governance problem because they combine human-like flexibility with machine-speed execution and persistence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:49 am
AI agent identity governance fails when organisations force autonomous software into a two-class model. The article shows that these systems are neither purely human nor purely machine in practice because they combine natural-language intent, token-based execution, and persistence. That creates a control blind spot in programmes that assume identity category determines governance path. The practitioner conclusion is that agent identity needs its own lifecycle and authorisation treatment, not a forced fit into legacy buckets.
A few things that frame the scale:
- Gartner predicts that AI systems will initiate 50% of all service requests by 2030, driven largely by agentic AI.
A question worth separating out:
Q: How can organisations reduce risk from long-lived AI agent access?
A: Organisations should shorten token lifetimes, require revocation paths, and make higher-risk actions trigger reconsent. If long-lived access is unavoidable, it should be tightly scoped, heavily audited, and tied to a documented ownership and review process so it does not become persistent standing privilege.
👉 Read our full editorial: AI agent identity governance needs a new control model