Topic starter
01/08/2026 8:53 pm
TL;DR: AI agents are increasingly acting on behalf of customers to research, compare, and transact, creating a governance problem that sits between fraud prevention and conversion, according to Transmit Security. The real issue is not whether to block automation, but whether organisations can identify agents, understand intent, and apply policy without breaking legitimate journeys.
Editorial analysis by NHI Mgmt Group, based on content published by Transmit Security: “It’s always been about visibility, but Understanding AI is an entirely new security category.”.
Key questions
Q: How should organisations handle customer-facing AI agents without blocking legitimate journeys?
A: Treat customer-facing AI agents as a governance problem, not a binary bot problem.
Q: Why do customer AI agents create fraud risk as well as conversion opportunity?
A: Because the same delegated automation that helps a real customer transact can also be used to hide abusive activity at machine speed.
Q: What breaks when bot management treats all automation as hostile?
A: Legitimate customer agents get blocked along with scrapers and credential stuffers, which damages conversion and pushes good traffic out of the experience.
Practitioner guidance
- Define customer-agent classification rules Separate legitimate delegated agents from unknown and malicious automation using identity, provenance, and behaviour signals before enforcing policy.
- Map high-risk customer journeys Identify the paths where AI agents research, compare, assemble carts, or enter checkout so stronger controls can be targeted only where fraud exposure is highest.
- Tune friction by journey risk Avoid blanket blocking at the edge and instead apply step-up checks only when an agent reaches sensitive actions such as payment, account changes, or fraud-prone flows.
Bottom line: AI agents are becoming a third traffic class that sits between humans and traditional bots, which makes identity and intent central to customer access control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:02 pm
Customer-facing AI agents create an identity classification problem before they create a fraud problem. The article makes clear that the real issue is not simply automation at the edge, but whether an organisation can tell who the agent represents and what it is trying to do. Once that identity signal is missing, policy becomes guesswork and every downstream decision gets weaker. Practitioners should treat agent identity as a prerequisite for any customer-traffic control model.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams measure to know if AI is helping governance?
A: Measure exception detection rates, approval quality, time-to-remediate risky access, and the percentage of reviews that produce actionable findings. If AI only reduces cycle time but does not improve those outcomes, it is adding efficiency without improving governance. Good measurement focuses on quality and closure, not just throughput.
👉 Read our full editorial: AI agent identity is reshaping customer traffic and fraud control