Topic starter
01/07/2026 1:55 am
TL;DR: AI agents and non-human identities are pushing privileged access beyond human-focused PAM and IAM models, with SSH Communications Security arguing that capability, visibility, and governance now matter more than identity type. That shift collapses static role assumptions and makes policy-based control, continuous auditing, and ephemeral access the new baseline.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “AI Agents Are Changing Access Management—Are You Ready?”.
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
Key questions
Q: How should security teams implement least privilege for AI agents and NHIs?
A: Start by treating AI agents as a separate identity class with explicit ownership, purpose, and lifecycle records.
Q: Why do static roles fail for AI agent authorization?
A: Static roles fail because they assume access needs stay stable long enough for onboarding, review, and revocation cycles to work.
Q: What are the warning signs that NHI governance is too focused on human users?
A: Common signs include user-centric access reviews, separate tooling for passwords but not API keys, and no clear owner for workloads or device identities.
Practitioner guidance
- Define privilege by capability Classify any identity that can modify systems, access sensitive data, execute transactions, or influence other identities as privileged, regardless of whether it is human, service-based, or agentic.
- Inventory all non-human identities Build a current inventory of service accounts, application identities, tokens, and AI agents, then record who owns each one and why it exists.
- Replace static role assumptions with policy controls Use policy-based and attribute-based authorisation where access needs to vary by context, task, or risk rather than remaining fixed to a role.
Bottom line: Privileged access is no longer bounded by human administrators, because AI agents and NHIs can exercise the same high-risk authority across systems and data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/07/2026 2:13 am
Capability, not identity type, is becoming the real privilege boundary. SSH Communications Security's analysis reflects a structural shift in identity governance: what an identity can do matters more than whether it is human, service, application, or AI-driven. That breaks the old assumption that privileged access can be inferred from account class alone. The practical implication is that governance must follow effective authority, not just identity taxonomy.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should security teams do when an AI agent needs privileged downstream access?
A: They should issue short-lived, session-scoped credentials tied to the approved task and let the resource owner enforce the operation natively. That keeps the agent’s access narrow, limits blast radius, and avoids giving a gateway the impossible job of re-authorising hidden downstream behaviour it cannot fully observe.
👉 Read our full editorial: AI agent privileges are forcing a reset in identity governance