Topic starter
24/06/2026 11:47 pm
AI agent identity governance is now a non-human identity problem, not an AI feature problem. These systems are acting across enterprise applications, APIs and infrastructure as operational identities with delegated reach. That moves the issue squarely into NHI governance, where ownership, entitlement scope, offboarding and audit evidence must follow the actor, not the application label. Practitioners should stop treating agent access as a separate innovation case and govern it as a live identity estate.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams do when AI agents need access to finance, HR or cloud systems?
A: Treat each environment as a separate governance domain and require task-specific entitlements, context-based approvals and recurring access reviews. The goal is to prevent an agent from accumulating broad delegated authority simply because it operates across business units.
👉 Read our full editorial: AI agent identity governance is outpacing enterprise IAM controls
25/06/2026 8:41 am
Static IAM governance was designed for identities with stable lifecycles, and that assumption fails under autonomous agents. Human users have joiner-mover-leaver events, and machine accounts usually have bounded purpose and predictable ownership. AI agents can appear, act, and disappear at runtime without the same lifecycle hooks, so the governance model loses its anchor. The implication is that identity programmes must stop treating lifecycle as a filing exercise and start treating runtime behaviour as the primary control signal.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who should own AI agent identity governance in an enterprise?
A: AI agent identity governance should sit jointly with IAM, platform security, and application owners because the risk crosses the runtime, the proxy, and the receiving service. No single team can see the whole delegation chain unless identity context is preserved end to end.
👉 Read our full editorial: AI agent identity risk is outpacing enterprise IAM controls