Topic starter
12/06/2026 12:23 am
TL;DR: AI agents are widening identity sprawl by requiring access to applications, API keys, passwords, and business data that existing IAM tools were not built to govern, according to 1Password’s summary of Omdia’s report. The real issue is not just access volume but the collapse of provisioning, auditability, and de-provisioning assumptions when agents operate continuously and at scale.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Why Omdia recommends Extended Access Management to secure agentic AI”.
Key questions
Q: What breaks when AI agents rely on static secrets?
A: Static secrets break the trust model because they are reusable, portable, and often broader than the task requires.
Q: Why do AI agents create more IAM risk than ordinary developer tools?
A: AI agents can make independent tool calls, chain actions, and authenticate with non-human identities while executing a task.
Q: How should security teams govern AI agents that were never formally provisioned?
A: Security teams should govern them through runtime discovery, ownership mapping, and behavioural controls rather than relying only on directory records.
Practitioner guidance
- Inventory agentic workflows and their identities Document every AI agent, service account, API key, password, and delegated token used by each workflow.
- Eliminate hardcoded agent credentials Replace plaintext and embedded secrets with centrally managed issuance, scoped access, and revocation logic that can be enforced without developer-side workarounds.
- Bound access to the task, not the agent Grant AI agents only the permissions required for a specific workflow window, then revoke or expire those permissions automatically when the task completes.
Bottom line: AI agent adoption is turning identity governance into a sprawl management problem because each workflow can create multiple non-human identities and access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:35 am
Agentic AI identity sprawl is now an IAM governance problem, not just a tooling gap. The article shows that AI agents are generating dozens of non-human identities and accessing multiple enterprise systems through credentials that existing IAM was never built to manage. That makes identity sprawl dynamic rather than static, with the governance burden shifting from account administration to lifecycle orchestration. Practitioners should stop treating these identities as incidental integrations and classify them as governed subjects in their own right.
A few things that frame the scale:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: When does AI agent access need additional accountability controls?
A: Additional accountability is needed when an agent can touch sensitive business data, financial workflows, or shared enterprise applications without a human in the loop. In those cases, organisations need logs, approval boundaries, and lifecycle ownership that make the agent's actions explainable after the fact.
👉 Read our full editorial: AI agent identity sprawl is exposing IAM gaps in enterprise access
This post was modified 1 day ago by NHI Mgmt Group