Topic starter
01/07/2026 1:59 am
TL;DR: At Identiverse 2026, the dominant message was that AI agent security now hinges on ownership, discovery, and runtime authorization, with practitioners also debating how to prove after the fact what agents touched and who is accountable, according to Delinea. The broader lesson is that standing secrets and one-time trust decisions no longer fit agent behaviour, so governance must move to action-time control.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “What Identiverse 2026 made clear about securing AI agents”.
By the numbers:
- In most cases, AI agents already outnumber people at almost 40 to 1.
Key questions
Q: What fails when AI agents are given access before they are inventoried?
A: Governance fails because the organisation cannot assign ownership, classify scope, or review access for agents it has not discovered.
Q: Why do runtime authorization controls matter for AI agents that inherit human entitlements?
A: Runtime authorization matters because an agent can combine inherited permissions in ways that static review does not anticipate.
Q: What are the signs that agent ownership is too weak to govern?
A: Common signs include agents created outside central IT, unclear accountability when an employee leaves, and no one able to explain which systems an agent can reach.
Practitioner guidance
- Assign hard ownership for every agent Bind each AI agent to a named human accountable for approval, review, and offboarding so lifecycle governance has a responsible subject.
- Inventory agents before granting scope Create a discovery workflow that identifies agents, their creators, and the systems they can reach before any access decision is made.
- Broker access at runtime Place a gateway in front of tools and APIs so each agent request is authorised at the moment of action, not through a standing token.
Bottom line: AI agent security is converging on ownership, discovery, and runtime authorization as the controls that matter most.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/07/2026 2:17 am
Ownership is the missing governance primitive for AI agents: an agent that cannot be tied to a named person cannot be reviewed, offboarded, or held to account in lifecycle processes. That is not a documentation issue. It is a control failure that turns agent proliferation into governance debt, especially when business teams deploy agents faster than IAM can catalogue them. The practitioner conclusion is that ownership must be treated as a hard requirement, not a courtesy.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat AI agents as NHI or as application automation?
A: They should treat them as governed non-human identities with application behaviour. That framing captures the need for identity, scope, lifecycle, and audit controls while still recognising that agents operate through APIs, tools, and workflows. Pure automation language hides the governance gap.
👉 Read our full editorial: Identiverse 2026 shows why AI agent identity needs runtime control