Topic starter
23/06/2026 9:13 pm
TL;DR: AI agents are already signing in, making requests, and triggering workflows across customer-facing apps, but existing identity architectures were not designed for agentic AI, according to Strivacity’s analysis of Forrester’s trends report. Consent, adaptive controls, lifecycle management, and unified audit trails now need to work for agents as well as people, or governance breaks at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Strivacity: “Strivacity Recognized in Forrester Report on Agentic AI and Identity Security”.
Key questions
Q: What breaks when AI agents are governed like ordinary service principals?
A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns.
Q: Why do AI agents create extra risk when they need to authenticate to other services?
A: AI agents expand risk because they often need reusable credentials to complete tasks across multiple systems.
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement.
Practitioner guidance
- Define a governed delegation model for AI agents Map each agent action back to an explicit authorising identity, consent record and permitted scope so the delegation chain stays legible.
- Extend adaptive controls to agent behaviour Apply the same risk signals used for customer sessions to agents, including step-up review when behaviour deviates from expected patterns.
- Put AI agents into lifecycle inventory Track agent onboarding, access scope changes, review dates and revocation status alongside other non-human identities.
Bottom line: AI agent governance is emerging as an identity architecture problem because existing IAM models were built for human-paced access, not delegated machine action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:23 am
AI agent identity exposes an IAM assumption gap, not just a new workload type. Existing IAM designs assume that delegated access can be expressed once, then governed through human-paced reviews and static credential boundaries. That assumption breaks when an agent can initiate actions at runtime across customer accounts, applications and workflows. The implication is that identity programmes must stop treating agent identity as an edge case and re-centre governance on runtime delegation.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: AI agent identity governance is exposing IAM design gaps