Topic starter
14/08/2026 6:33 pm
TL;DR: AI agents are moving into production with the ability to research, code, call applications, and chain tasks, exposing an identity model that conventional IAM and shared credentials were never built to govern, according to iProov’s analysis of Gartner’s 2026 Digital Identity Hype Cycle. The real problem is not authentication alone, but scoping, accountability, and continuous authorisation for non-human actors.
Editorial analysis by NHI Mgmt Group, based on content published by iProov: “AI Agents are Changing Digital Identity. Is your IAM Strategy Ready?”.
By the numbers:
- 94% of organizations are dealing with increased machine identities, largely driven by AI and AI agent deployments.
Key questions
Q: What breaks when AI agents are connected through personal accounts or shared credentials?
A: Shared or personal credentials break accountability, lifecycle control, and revocation.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: How can security teams tell whether agent access is actually under control?
A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.
Practitioner guidance
- Inventory every agent workflow Map all sanctioned and unsanctioned AI agent use cases, then record which ones run on human credentials, shared service accounts, or long-lived keys.
- Replace borrowed credentials with dedicated identities Assign each agent a unique identity, remove shared logins from the path, and make revocation possible without affecting unrelated workloads.
- Enforce task-scoped access boundaries Set permissions for the shortest practical task window, then narrow access to the specific systems and data needed for that run.
Bottom line: AI agents are exposing a governance gap that conventional IAM cannot close because their access patterns are dynamic, continuous, and not tied to a single human role.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:41 pm
AI agent identity exposes a governance mismatch, not just a new authentication problem: IAM assumes stable human roles, predictable sign-in patterns, and an audit trail tied to one accountable person. Agents break all three assumptions because they can act continuously, switch tasks, and represent multiple people in one day. The implication is that identity programmes must treat agent behaviour as a separate governance class, not as a variation of user access.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: AI agent identity is outgrowing conventional IAM controls