Topic starter
12/06/2026 10:01 pm
TL;DR: Machine identities now outnumber human employees by 82 to 1, while 59% of employees are using unapproved AI tools and 75% admit to sharing sensitive data with them, according to JumpCloud. The old human-versus-service-account model no longer fits autonomous behaviour, and access governance now has to account for identity that can decide and act at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Beyond the Binary: Why 2026 Demands a New Identity Category”.
By the numbers:
- Machine identities now outnumber human employees by an average of 82 to 1.
- 59% of employees are using unapproved AI tools.
- 75% of employees using unapproved AI tools admit to sharing sensitive data with them.
Key questions
Q: What breaks when AI agents inherit access from users and service accounts?
A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern.
Q: Why do AI agents need special governance compared with normal applications?
A: AI agents make decisions about which tools to use and how to use them, so they can be manipulated by malicious context as well as code.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define a third identity class for AI agents Separate autonomous tools from both people and standard service accounts in your identity taxonomy so governance, ownership, and audit trails match behaviour rather than label.
- Inventory shadow AI alongside other NHIs Require business units to register any AI tool that can access internal systems, data, or workflows, including pilot tools used outside approved procurement paths.
- Limit write access for autonomous agents Treat any AI agent with write permissions as high risk and confine it to narrowly scoped, time-bound access with explicit oversight for destructive actions.
Bottom line: AI agents expose a structural gap in identity governance because they can behave like neither deterministic service accounts nor accountable human users.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:31 am
AI agents break the service-account assumption that runtime behaviour is predetermined. Service accounts are governed as if the identity executes a known task set, but autonomous AI can choose actions dynamically within a session. That is an assumption collapse, not just a control gap. The implication is that identity governance has to move from provisioning-time certainty to runtime behaviour governance.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when AI agents are given permission to generate code or modify systems?
A: Organisations should require explicit approval for high-risk actions, segment agent permissions by use case, and log every material action for auditability. They should also test whether tool descriptions or hidden context can alter model behavior before deployment. If an agent can write code or change systems, its controls need to be closer to privileged automation than to a chat interface.
👉 Read our full editorial: AI agents break the human versus service account identity model
This post was modified 6 days ago by NHI Mgmt Group