Notifications
Clear all
Topic starter
14/08/2026 6:33 pm
TL;DR: AI agents are moving into production with the ability to research, code, call applications, and chain tasks, exposing an identity model that conventional IAM and shared credentials were never built to govern, according to iProov’s analysis of Gartner’s 2026 Digital Identity Hype Cycle. The real problem is not authentication alone, but scoping, accountability, and continuous authorisation for non-human actors.
NHIMG editorial — based on content published by iProov: AI agent identity is outgrowing conventional IAM controls
By the numbers:
- 94% of organizations are dealing with increased machine identities, largely driven by AI and AI agent deployments.
- Only 5.7% of organizations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorized access and broadening the attack surface.
Questions worth separating out
Q: How should organizations manage credentials for AI agents?
A: Organizations should transition from hard-coded credentials to runtime-fetched credentials that enhance security by ensuring that tokens are not stored permanently.
Q: Why do AI agents make existing IAM controls harder to rely on?
A: Because many IAM controls assume access is stable long enough to be reviewed, certified, and revoked later.
Q: What breaks when organizations let AI agents borrow employee logins?
A: The audit trail becomes ambiguous, access reviews lose meaning, and accountability shifts from a specific actor to a generic human account.
Practitioner guidance
- Map every agent-linked identity path Inventory where AI agents use shared service accounts, static API keys, or borrowed employee logins, and record the business owner for each credential path.
- Separate human and agent accountability Assign dedicated identities for agent workflows so audit logs preserve who authorized the task, what system was touched, and which principal benefited from the action.
- Constrain access to task scope Set permissions to the minimum resource set needed for a single workflow, then re-check access before the agent moves to a new system or transaction.
What's in the full article
iProov's full post covers the operational detail this analysis intentionally leaves for the source:
- Gartner Hype Cycle references and the specific identity technologies grouped around AI agent identity.
- The article's full explanation of why intent-based access control matters for agent workflows.
- The source's own breakdown of where organisations should start mapping sanctioned and shadow AI agent use.
- The surrounding context on how identity visibility platforms and workload access management fit the emerging model.
👉 Read iProov's analysis of AI agent identity and the future of IAM →
AI agent identity and IAM: are your controls keeping up?
Explore further
14/08/2026 6:41 pm
AI agent identity exposes a governance gap that conventional IAM was never designed to close. Traditional IAM assumes a stable person, a known role, and a reviewable access lifecycle. Agents break that model because the same runtime identity can act for multiple principals and across multiple systems in rapid succession. The result is not just more access, but less meaningful attribution. Practitioners should treat that as a structural governance problem, not a tuning issue.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which explains why agent governance often starts with discovery rather than policy.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unsafe action?
A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.
👉 Read our full editorial: AI agent identity is outgrowing conventional IAM controls
