Notifications
Clear all
Topic starter
14/08/2026 6:37 pm
TL;DR: Manual provisioning is slowing AI deployment and inflating access risk because agents are being granted fragmented, overbroad access through human workflows, according to Oleria Security. Identity has to become the control plane for AI agents, or organisations will keep trading speed for governance.
NHIMG editorial — based on content published by Oleria Security: Fix identity for AI
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents make over-provisioning more dangerous than with human users?
A: Because agents can inspect entitlements and act on them at machine speed without the human hesitation that often limits real-world misuse.
Q: What breaks when AI agent identity is split across multiple tools?
A: Governance breaks first.
Practitioner guidance
- Inventory AI agent identity artifacts now Map every agent to its service principals, OAuth grants, API keys, tokens, and owning team so you can see where governance is currently split across systems.
- Define explicit agent lifecycle states Create join, move, change, and retire states for agents, then tie each state to a revocation or approval path that does not depend on a human remembering to file a ticket.
- Replace broad manual approvals with purpose-bound access models Approve access against a stated agent purpose and expected business outcome, then constrain entitlements so the agent receives only the systems it needs for that task.
What's in the full article
Oleria Security's full blog post covers the operational detail this post intentionally leaves for the source:
- How the vendor maps AI agent identity into a unified identity graph across human and non-human systems
- The five operational capabilities the vendor says an AI identity platform needs for ownership, lifecycle, visibility, governance, and response
- The article's specific framing on how access should be scoped, adjusted, and revoked at machine speed
- The RSA 2026 context and the vendor's own explanation of why security leaders are prioritising identity for AI deployment
👉 Read Oleria Security's analysis of AI agent identity governance and access bottlenecks →
AI agent identity governance: are manual approvals the bottleneck?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/08/2026 6:44 pm
Manual provisioning is the wrong control model for AI agent identity. The article exposes a basic governance mismatch: AI agents move at runtime speed, while identity teams still rely on ticket queues, approvals, and handoffs designed for people. That mismatch does not just slow deployment, it forces practitioners to choose between speed and restraint. The practical conclusion is that agent identity has to be governed as a dynamic identity state, not a request-processing workflow.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage.
A question worth separating out:
Q: Who is accountable when an AI agent acts outside its intended scope?
A: The organisation is accountable, but operational responsibility should sit with a named owner and a governance process that can explain the agent’s purpose, access, and recorded actions. Without that, autonomous behaviour becomes unassignable risk rather than managed automation.
👉 Read our full editorial: AI agent identity governance fails when access is still manual
