Topic starter
24/07/2026 4:09 pm
TL;DR: AI agents are spreading across homegrown, SaaS, and developer environments, but most teams still govern them as if they were service accounts and API keys, according to Noma Security. That model misses runtime delegation, ownerless agents, and tool-chaining behaviour that makes identity control and accountability materially harder.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “The Four Dimensions of Agentic Identity Security Teams Need to Understand”.
Key questions
Q: What breaks when AI agents are governed like ordinary service principals?
A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns.
Q: Why do AI agents create accountability problems for IAM and NHI teams?
A: AI agents create accountability problems because traditional IAM proves who authenticated, while agent governance must prove what the actor did with that access.
Q: What are the signs that delegated AI access is too ambiguous to govern safely?
A: Look for logs that only show the human user, tokens that never record the agent, and downstream services that cannot distinguish a delegated action from direct user activity.
Practitioner guidance
- Map agent ownership and edit rights Create an inventory that records who built each agent, who can modify its tools, and who is accountable when behaviour changes or permissions drift.
- Separate maker authority from user authority Do not let the credentials of the agent creator define the permissions of every later user.
- Trace delegation chains end to end Require visibility into each tool call, sub-agent handoff, and downstream authorization step so that permission inflation is detectable before it becomes normal.
Bottom line: AI agent identity cannot be reduced to service account management because runtime decisions, delegation chains, and inherited permissions expand the governance problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:14 pm
AI agent identity has outgrown service account governance because the governing object is no longer static. Service accounts can be described at provisioning time, but agents change the way they use identity while the session is still active. That makes runtime behaviour part of the identity record, not just the workload description. The practical consequence is that identity governance must move from pure asset control to continuous authority tracking.
A few things that frame the scale:
- Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
A question worth separating out:
Q: How should security teams govern agent workflows at runtime?
A: Security teams should govern agent workflows with controls that evaluate prompts, tool calls, and outputs during execution, not only after deployment. Runtime checks matter because risk can appear at each stage of the workflow. The goal is to stop unsafe behavior before it becomes an executed action or a leaked response.
👉 Read our full editorial: AI agent identity is outgrowing service account governance