Topic starter
28/05/2026 11:37 am
TL;DR: Only 17% of organisations govern AI identities the same way they govern human identities, leaving agents free to accumulate privileges, expand scope and act at machine speed, according to Saviynt. Lifecycle governance, not just runtime policy, becomes the control plane problem when agents can be provisioned, over-entitled and retired faster than access reviews can catch up.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “From Code to Decommissioning: How Saviynt and LangChain Are Securing the AI Agent Lifecycle”.
By the numbers:
- Only 17% of organisations govern their AI identities the same way they govern human identities, according to Saviynt.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI assistants create more risk than traditional service accounts?
A: AI assistants create more risk because they can be influenced by inputs, context, and hidden instructions after authentication succeeds.
Q: What are the signs that an agent governance programme is failing?
A: Common signals include unknown agents in staging or production, unvetted MCP connections, broad or long-lived credentials, and logs that show service-account activity without clear ownership.
Practitioner guidance
- Define agent identity at creation Require an owner, scope boundaries and tool entitlements before an AI agent is allowed to run in production.
- Gate tool calls with live policy checks Block actions when the requested tool use falls outside the agent’s current approved scope, even if the credential still authenticates.
- Track lifecycle state from build to retirement Maintain a lifecycle record that shows when the agent was created, what it could access, how its scope changed and when it was retired.
Bottom line: AI agents are being deployed with identity assumptions that were built for slower, more visible subjects, which creates a governance gap at creation and retirement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:42 am
AI agent lifecycle governance is now the control plane, not a secondary policy layer. The article’s core point is that agents can be provisioned, expanded, monitored and retired faster than traditional identity programmes are built to observe them. That changes governance from a periodic review activity into a lifecycle control requirement. Practitioners should treat creation, use and decommissioning as one continuous identity boundary.
A question worth separating out:
Q: How should security teams govern AI agents that use multiple identity layers?
A: Security teams should inventory every identity layer an agent can use, including static credentials, session identities, embedded tool identities, and any delegated relationships between agents. Governance fails when one layer is controlled while another remains open, because the agent can still act through the weaker path. Treat the layered identity surface as the actual access boundary.
👉 Read our full editorial: AI agent lifecycle governance is the new identity control plane