Topic starter
06/11/2026 6:39 pm
TL;DR: Gartner says AI agent identity is now one of its top strategic technology trends, alongside a forecast that 25% of enterprise security breaches will be linked to AI agent abuse by 2028 and 50% of organisations will run agents with minimal human involvement by 2030, according to Aizome. Identity controls built for human logins do not govern autonomous execution, intent drift, or attributable tool use.
Editorial analysis by NHI Mgmt Group, based on content published by Aizome: “Gartner Just Named AI Agent Identity a Top 10 Strategic Technology Trend. Here’s What That Means.”.
By the numbers:
- 25% of enterprise security breaches will be linked to AI agent abuse by 2028, according to Gartner research cited by Aizome.
- 50% of organisations will be running AI agents with minimal human involvement in IT operations by 2030, according to Gartner research cited by Aizome.
Key questions
Q: What should teams do first when AI systems start operating on existing access paths?
A: Start by removing the access paths that require the least governance and create the highest blast radius.
Q: Why do existing IAM controls struggle with autonomous AI agents?
A: Existing IAM controls were designed around human users and predictable workload behaviour.
Q: How do organisations know if an AI system has drifted beyond its mandate?
A: Organisations know an AI system has drifted when its behaviour remains technically permitted but no longer matches the intended purpose, scope, or business outcome.
Practitioner guidance
- Establish governed identities for every AI agent Assign each agent an explicit owner, declared purpose and expiry condition so access can be tied to accountability from day one.
- Scope agent permissions to task boundaries Remove inherited human access wherever possible and issue only the minimum tool and system access needed for the agent's current job.
- Monitor live behaviour against declared intent Compare actual tool use, data reach and action patterns against the agent's approved purpose to detect drift before it becomes an incident.
Bottom line: AI agents create an identity problem because they can keep acting after the human operator has stepped out of the loop.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
AI agent identity is now a governance primitive, not an application feature. The reason is simple: once software can independently initiate action, the old split between authentication, authorisation and workflow execution becomes too thin to carry accountability. Security leaders need to treat the agent itself as the governed subject, because the board-level risk is not the model prompt but the actor that keeps working after the human has moved on.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between access control and intent governance for AI agents?
A: Access control answers whether an identity is allowed to do something. Intent governance asks whether the action makes sense in the current context and whether the input driving that action is trustworthy. For AI agents, both are necessary because legitimate permissions can still be abused through malicious content.
👉 Read our full editorial: AI agent identity governance is becoming a board-level control