Notifications
Clear all
Topic starter
23/06/2026 9:13 pm
TL;DR: AI agents are already signing in, making requests, and triggering workflows across customer-facing apps, but existing identity architectures were not designed for agentic AI, according to Strivacity’s analysis of Forrester’s trends report. Consent, adaptive controls, lifecycle management, and unified audit trails now need to work for agents as well as people, or governance breaks at runtime.
NHIMG editorial — based on content published by Strivacity: AI agent identity governance and the controls that matter
Questions worth separating out
Q: How should security teams govern AI agents that act on behalf of customers?
A: Security teams should govern AI agents as delegated identities, not as ordinary service accounts.
Q: Why do AI agents complicate existing IAM controls?
A: AI agents complicate IAM because they operate at machine speed, can change behaviour within a session, and may keep acting after the original approval context has faded.
Q: What breaks when AI agent actions are logged separately from identity events?
A: When agent actions are split from identity events, teams lose the ability to prove consent, reconstruct delegation, and answer what happened during an incident.
Practitioner guidance
- Bind agent actions to explicit delegated consent Require every customer-facing agent to inherit a clearly scoped consent record that defines what it may do, when that approval expires, and how revocation is enforced across downstream systems.
- Extend adaptive controls to non-human sessions Treat unusual agent request patterns, rapid traversal, and unexpected action sequences as triggers for step-up authentication or human review before the workflow completes.
- Create one audit trail for people and agents Correlate identity proofing, authentication, consent, and executed actions into a single trace so investigations can reconstruct who authorised the agent and what it did.
What's in the full article
Strivacity's full report covers the operational detail this post intentionally leaves for the source:
- Identity proofing flow details for verifying AI agents and the humans or organisations behind them before access begins.
- Consent and delegation mechanics for binding each agent action to an explicit customer authorisation record.
- Adaptive access policy examples showing when step-up authentication or human approval should interrupt an agent session.
- Unified audit and self-service revocation workflows for teams that need to operationalise agent governance in production.
👉 Read Strivacity's analysis of AI agent identity governance in customer-facing applications →
AI agent identity governance: are your IAM controls ready?
Explore further
25/06/2026 2:23 am
AI agent governance is now a customer identity problem, not just a machine identity problem. The article shows agents signing in and acting on behalf of customers, which means the identity model has shifted from workload authentication to delegated customer action. That is materially different from a backend service account that only moves data between systems. IAM and CIAM teams should treat agent identities as governed actors whose behaviour must be tied to consent, purpose, and revocation.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Another finding from the same research shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a compliance and investigation blind spot.
A question worth separating out:
Q: What should organisations do before scaling AI agent access?
A: Organisations should define ownership, consent, auditability, and revocation for agents before broad deployment. If the agent can access customer accounts, the control set must be in place at design time, not after the first incident. Scaling without those controls turns experimentation into governance debt.
👉 Read our full editorial: AI agent identity governance is exposing IAM design gaps
