Topic starter
19/08/2026 4:05 pm
TL;DR: AI agent adoption is already ahead of governance, with Ory and EMA finding that 98% of organisations already use or plan to use them while 79% still lack documented policies. Identity controls need ownership, runtime access, and revocation paths that survive agent growth.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “Managing Agentic Identities at Scale: What Will You Do When You Have 10,000 AI Agents? (And then 100,000? or a Million?)”.
By the numbers:
- 98% of respondents were in production, had a pilot program, or were planning one for AI agents.
- 79% of those organisations lack written policies for governing AI agents.
Key questions
Q: Why do service accounts and AI agents create different identity risk than employees?
A: Service accounts and AI agents create different risk because they are not managed through HR lifecycle events, yet they often hold broad technical permissions and can act at machine speed.
Q: How can organisations tell whether AI agent governance is actually working?
A: Look for evidence that agent access is ephemeral, traceable, and constrained at the action level.
Q: What breaks when an AI agent is deployed without formal ownership?
A: When an AI agent has no formal owner, review, offboarding, and incident response all become slower and less reliable.
Practitioner guidance
- Define agent identities at creation Assign each AI agent a unique identity, owner, purpose, and expiry condition before it is allowed into production workflows.
- Eliminate shared agent credentials Replace shared tokens and hardcoded secrets with individually scoped credentials that can be revoked without affecting unrelated services.
- Make revocation operationally survivable Map downstream dependencies so that token rotation or identity shutdown does not break hidden production integrations.
Bottom line: AI agent adoption is already ahead of governance, and that gap is now a production identity problem rather than a future planning issue.
Glossary terms: Agent Identity, Identity Blast Radius, Runtime Authorisation, Credential Rebinding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:39 pm
Agentic identity governance fails when organisations treat AI agents as temporary automation. The article shows that agents are already in production, but the governance model remains anchored to pilot-era assumptions about ownership, review, and revocation. That gap is now large enough to create systemic identity risk, not just isolated policy failures. Practitioners should treat agent identity as a first-class lifecycle domain.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when AI agents use shared credentials across workflows?
A: Accountability belongs to the organisation that owns the credential lifecycle and the policy attached to it. When shared secrets are used across humans, agents, and machines, the governance model must still identify which actor used the credential, under what approval path, and for what task. Without that, accountability becomes ambiguous.
👉 Read our full editorial: Managing 100,000 AI agents needs a scalable identity model