Topic starter
25/06/2026 2:44 pm
TL;DR: Renee Guttmann argues that rapid AI adoption has created a gap between non-human identity risk and traditional IAM, with non-human identities now outnumbering human ones by ratios exceeding 80:1 in some organisations, according to Aembit. The key issue is not just access volume but governance assumptions that were built for static systems and human users.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “Veteran CISO and Aembit Adviser Renee Guttmann on Guiding Security into the AI Age”.
By the numbers:
- Non-human identities now outnumber human ones by ratios exceeding 80:1 in some organisations, according to Aembit.
Key questions
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI assistants create more risk than traditional service accounts?
A: AI assistants create more risk because they can be influenced by inputs, context, and hidden instructions after authentication succeeds.
Q: What are the signs that access governance is failing in practice?
A: The clearest signs are slow remediation, repeated rubber stamp access reviews, and missed permissions outside traditional HR linked systems.
Practitioner guidance
- Map AI agents to distinct identity lifecycles Create separate governance paths for AI agents, service accounts, and human users so each subject has an explicit owner, purpose, and retirement condition.
- Bind agent privileges to task scope Define the minimum access an AI agent needs for a specific workflow and prohibit reuse of that access outside the approved runtime context.
- Eliminate shared non-human credentials Remove credential sharing across agents, pipelines, and teams, then assign each agent its own accountable identity boundary and revocation path.
Bottom line: AI agent identity governance is forcing IAM teams to confront controls that were built for stable human and workload identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 18 hours ago by NHI Mgmt Group
25/06/2026 3:51 pm
AI agent identity governance exposes a runtime decision problem, not just an account management problem. Traditional IAM was designed for identities whose privileges could be assigned and reviewed against a stable role or workload. AI agents change that model because the meaningful control point is often the session or task boundary, not the directory entry. The implication is that governance teams must stop treating agent access as a static entitlement and start treating it as a runtime authorization decision.
A question worth separating out:
Q: When should organisations separate AI agent governance from human IAM reviews?
A: Organisations should separate them as soon as AI agents begin acting inside production workflows. Human access reviews assume a person, a role, and a review cadence that fit a stable entitlement. AI agents require task-scoped boundaries, lifecycle ownership, and monitoring that can keep up with runtime behaviour.
👉 Read our full editorial: AI agent identity governance is outpacing traditional IAM controls
This post was modified 18 hours ago by NHI Mgmt Group