Topic starter
24/07/2026 4:07 pm
TL;DR: The human-to-non-human identity ratio has reached 1:82, and identity-related incidents and compromised credentials keep identity governance at the center of AI deployment risk, according to Saviynt. Periodic review is no longer enough when AI agents can accumulate access faster than traditional IAM can observe or certify it.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Every AI Agent Is an Identity. Are You Governing Them?”.
By the numbers:
- The ratio of human to non-human identities in modern enterprises has reached a staggering 1:82.
- Only 24% of GenAI projects are being secured.
- 97% of AI breaches lacked proper access controls.
Key questions
Q: What breaks when AI agents are reviewed like human users?
A: Human review assumes access is stable long enough to be observed, approved, and recertified.
Q: Why do AI agents increase non-human identity risk?
A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define an inventory baseline for all non-human identities Establish a single authoritative inventory for AI agents, service accounts, API keys, and other machine identities so ownership and scope are visible before access reviews begin.
- Shift from quarterly review to continuous posture management Replace certification-only governance with continuous posture checks that surface excessive entitlements, dormant accounts, and orphaned credentials as they appear.
- Separate governance from pure access enforcement Align IAM and PAM with a governance layer that tracks inventory, ownership, compliance status, and reviewability across humans and non-humans.
Bottom line: AI agent governance is moving into the centre of identity architecture because non-human identities now outnumber humans by a wide margin and legacy review cycles cannot keep up.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:11 pm
AI agent governance is now an identity architecture problem, not a narrow AI add-on. The article reflects a broader shift: once machine and autonomous identities outnumber people, identity governance becomes the control plane that determines whether AI can be deployed safely at scale. That changes how security leaders should think about ownership, review, and accountability across the full identity estate. Practitioners should treat AI agent governance as part of core identity architecture, not as a side project.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: AI agent governance becomes the new identity control plane