Notifications
Clear all
Topic starter
24/06/2026 8:38 pm
TL;DR: As AI agents embed across enterprise systems, every AI identity needs a named human owner to preserve visibility, accountability, and trust as autonomy scales, according to SPHERE. That shifts AI governance from a policy exercise to an identity ownership problem, with downstream consequences for IAM, IGA, and lifecycle control.
NHIMG editorial — based on content published by SPHERE: Guardians of AI
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern AI agents that operate in enterprise systems?
A: Security teams should govern AI agents as identities with explicit ownership, scoped access, and lifecycle controls.
Q: What breaks when an AI agent has no named owner?
A: Without a named owner, no one is clearly accountable for approvals, exceptions, investigations, or offboarding.
Q: Why do AI agents change IAM and IGA operating models?
A: AI agents can use access dynamically at runtime, so static role assignment is not enough on its own.
Practitioner guidance
- Assign a named owner to every AI agent Record a human owner, technical custodian, and business approver for each production agent before it is granted access to enterprise systems.
- Extend registration to behavioural boundaries Document what the agent is allowed to do, which systems it may touch, and which actions require review or suspension.
- Add agent ownership to access review workflows Include the owner, approval basis, and exception history in review evidence so reviewers can assess both entitlement and accountability.
What's in the full article
SPHERE's full analysis covers the operational detail this post intentionally leaves for the source:
- The specific ownership model SPHERE uses to tie AI identities back to human accountability
- The interview context around how ownership should be reflected in governance workflows
- The full discussion of visibility and trust as AI autonomy scales across enterprise systems
- Additional SPHERE perspective on how governance should be built in by design
👉 Read SPHERE's analysis of why AI agents need named human owners →
AI agent ownership: what it means for identity teams?
Explore further
25/06/2026 5:19 am
Named ownership is the missing identity control for AI agents. Once an AI agent can act independently inside enterprise systems, the question is no longer whether access exists. The real question is who owns the behaviour, the exception path, and the investigation trail when that behaviour crosses scope. Ownership is what converts AI activity from an opaque technical event into a governable identity relationship. Practitioners should treat named ownership as a mandatory control, not a policy preference.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, which leaves 48% with a blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who should be accountable when an AI agent misuses access?
A: Accountability should sit with the named business owner supported by the technical custodian, not with an anonymous platform team. That split keeps ownership visible, gives audit teams a clear escalation path, and prevents AI identities from becoming ungoverned access proxies.
👉 Read our full editorial: Named ownership for AI agents is now an identity control
