Topic starter
30/07/2026 10:49 pm
TL;DR: AI agents and machine identities are exposing a structural gap in IAM, because two decades of identity tooling were built around login events and declared accounts rather than continuous runtime behaviour, according to Orchid Security. The real break point is authority, not another integration layer: existing fabric models can correlate what is already visible, but they cannot govern identities that were never declared.
Editorial analysis by NHI Mgmt Group, based on content published by Orchid Security: “Redefining IAM: More Than a Marketing Message”.
By the numbers:
- 46% of identity activity already occurs outside centralized IAM visibility entirely, according to Orchid Security.
Key questions
Q: What breaks when identity governance focuses only on account counts?
A: When governance focuses only on account counts, teams miss the identities that can actually reach sensitive data or production systems.
Q: Why do AI agents expose gaps in existing IAM models?
A: AI agents expose gaps because they do not fit the assumption that access can be assigned once and then managed through periodic reviews.
Q: How can security teams tell whether identity fabric is working?
A: Security teams can tell identity fabric is working when policy intent is enforced consistently, access changes propagate cleanly, and audit evidence can be reconciled across environments.
Practitioner guidance
- Map identities that never enter the governed inventory Inventory service accounts, hardcoded credentials, tokens, and application-local identities that sit outside IdP and IGA coverage.
- Define runtime authority checkpoints for AI agents Place control at the moment an agent requests or uses access, rather than relying on later certification or review.
- Separate declaration from attribution in your governance model Track whether an identity is known to the stack and who is accountable for the actions it performs.
Bottom line: Traditional IAM still assumes a login event, but AI agents and machine identities often operate outside that pattern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:57 pm
Identity fabric is a correlation layer, not a control plane for unseen identity. The article is right to separate connection from governance. A fabric can unify declared accounts, but it cannot create visibility into identities that were never onboarded, never inventoried, or never made observable at runtime. That distinction matters because modern risk increasingly lives in the gap between declaration and behaviour. Practitioners should stop treating unified dashboards as proof of control coverage.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do before expanding AI agent deployments?
A: They should define agent-specific identity controls before scaling. That means narrowing tool access, documenting delegated permissions, assigning ownership, and deciding how agent activity will be reviewed or terminated. If those controls are built after rollout, the organisation will inherit a much larger identity surface than it can govern confidently.
👉 Read our full editorial: Redefining iam for ai agents requires authority, not more integration