Notifications
Clear all
Topic starter
30/07/2026 10:49 pm
TL;DR: AI agents and machine identities are exposing a structural gap in IAM, because two decades of identity tooling were built around login events and declared accounts rather than continuous runtime behaviour, according to Orchid Security. The real break point is authority, not another integration layer: existing fabric models can correlate what is already visible, but they cannot govern identities that were never declared.
NHIMG editorial — based on content published by Orchid Security: Redefining IAM for what's actually coming
By the numbers:
- 46% of identity activity already occurs outside centralized IAM visibility entirely.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
Questions worth separating out
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents expose the limits of identity fabric?
A: Identity fabric is effective for correlating declared data across IAM, IGA, PAM, and cloud tools.
Q: How do organisations know whether non-human identity governance is working?
A: Look for three signals: fewer standing credentials, faster revocation of secrets and tokens, and evidence that access decisions match the actual runtime behaviour of the identity.
Practitioner guidance
- Inventory identities that never enter the IdP Find service accounts, API keys, embedded application secrets, and local accounts that exist outside centralized IAM visibility.
- Separate discovery from integration programmes Do not treat connector rollout as discovery.
- Define runtime authority owners for agents and workloads Assign a human owner for each AI agent or workload identity and require accountability for every action path that can be exercised without a login event.
What's in the full article
Orchid Security's full blog post covers the architectural argument and implementation context this post intentionally leaves for the source:
- The distinction between identity fabric, control plane, and point-of-execution visibility in real enterprise architectures
- The AI-agent scenario used to illustrate how undeclared access can remain invisible to traditional IAM tooling
- The vendor's critique of connector-based governance and what it means for next-generation identity programmes
- The closing architectural recommendation for teams deciding whether to extend, replace, or supplement their current identity stack
👉 Read Orchid Security's analysis of redefining IAM for AI agents →
AI agent identity governance: what changes when authority matters more?
Explore further
30/07/2026 10:57 pm
Identity fabric is a visibility layer, not an authority layer. Correlating IdP, IGA, PAM, and cloud signals improves the completeness of declared access data, but it does not create ground truth for identities that never entered those systems. The industry keeps treating better correlation as a substitute for runtime control. That is the wrong mental model for agentic environments, where software can act outside the old authentication rhythm and still produce business-impacting outcomes.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Another NHIMG finding shows that only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: Who is accountable when an AI agent acts outside its intended scope?
A: The organisation is accountable, but operational responsibility should sit with a named owner and a governance process that can explain the agent’s purpose, access, and recorded actions. Without that, autonomous behaviour becomes unassignable risk rather than managed automation.
👉 Read our full editorial: Redefining iam for ai agents requires authority, not more integration
