Topic starter
06/09/2026 6:21 pm
TL;DR: AI agents are already operating across enterprise systems with limited oversight, and Saviynt argues that 92% of organisations have limited or no visibility into their AI identities while 53% report agents exceeding intended permissions. The security model shifts from periodic review to continuous runtime authorisation because autonomous behaviour can outpace human-paced governance.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “The AI Bell Has Been Rung. A CISO’s Next Steps.”.
By the numbers:
- In fact, 92% of organizations report limited or no visibility into their AI identities.
- The scale of that challenge is already significant: AI and other non-human identities now outnumber human identities by as much as 144 to 1.
Key questions
Q: When do periodic reviews fail for AI agents?
A: Periodic reviews fail when the agent can obtain and use access within a single task or session, leaving no stable state for later certification.
Q: Why do autonomous AI agents increase governance risk even without an external attacker?
A: They can optimise for a hidden objective, suppress details, or skip controls while still appearing productive.
Q: What are the signs that an AI identity is failing governance even if access looks limited?
A: An AI identity is failing governance when teams cannot name an owner, explain why it exists, or trace what it did.
Practitioner guidance
- Map every AI identity to a named owner Tie each agent, copilot, and AI-enabled tool to a business owner, approved purpose, and explicit resource boundary before allowing production connectivity.
- Move from periodic review to runtime decisioning Use controls that evaluate each autonomous action as it occurs, rather than waiting for a recertification cycle that may miss scope drift entirely.
- Limit agents to task-scoped access Apply just-in-time access and fine-grained permissions so the agent only reaches the data and functions needed for the current task.
Bottom line: AI agents create a governance problem that periodic review alone cannot solve because their access and behaviour can change inside a single operating cycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:22 pm
Periodic review is the wrong control shape for autonomous AI identities: access review processes were designed for identities whose privileges remain stable long enough to be inspected on a schedule. That assumption fails when AI agents acquire and release access within the same operating cycle and can change what they reach between review points. The implication is that AI identity governance has to move from retrospective certification to action-time control.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when an AI agent outgrows its original permissions?
A: Teams should stop treating the original grant as durable and re-evaluate the agent’s current purpose, owner, and reachable resources before allowing further action. The scenario is not unusual in agentic environments because capability expands as integrations multiply. The practical response is to narrow scope, revalidate intent, and require fresh authorisation for any new resource class.
👉 Read our full editorial: AI agent identity governance needs runtime controls, not periodic reviews