Notifications
Clear all
Topic starter
19/08/2026 4:05 pm
TL;DR: A recent survey found that 98% of organisations already use or plan to use AI agents, while 79% still lack documented policies for governing them, highlighting how quickly agentic adoption is outrunning identity controls, according to Ory and EMA. The governance problem is no longer theoretical: access, ownership, and revocation assumptions built for slower human and service-account lifecycles do not hold at agent scale.
NHIMG editorial — based on content published by Ory: Managing Agentic Identities at Scale, What Will You Do When You Have 10,000 AI Agents?
By the numbers:
- 98% of respondents were in production, had a pilot program, or were planning one for AI agents.
- 79% of organisations lack written policies for governing AI agents.
Questions worth separating out
Q: How should security teams limit the risk from AI agents that have access to production systems?
A: Security teams should scope every agent to the smallest set of actions and resources needed for its task, then remove standing privilege wherever possible.
Q: Why do AI agents create new risk in non-human identity management?
A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts.
Q: What breaks when AI agents are connected through personal accounts or shared credentials?
A: Shared or personal credentials break accountability, lifecycle control, and revocation.
Practitioner guidance
- Define agent ownership before deployment Assign a named business and technical owner to every AI agent, with explicit authority for approval, review, and shutdown.
- Replace shared secrets with scoped, revocable credentials Issue agent credentials that are individually traceable, narrowly scoped, and easy to revoke without affecting unrelated workloads.
- Build agent policy into the deployment path Require documented access policy, authorisation scope, and revocation criteria before an agent can move from pilot to production.
What's in the full article
Ory's full article covers the operational detail this post intentionally leaves for the source:
- The survey framing and adoption breakdown behind the 98% agentic deployment figure
- The platform-level identity model Ory proposes for agents, users, and services under Zero Trust
- Implementation detail on token rotation, revocation, and auditing in agent workflows
- The CockroachDB integration discussion for globally distributed identity data and behavioural tracking
👉 Read Ory's analysis of identity governance for 10,000 AI agents →
AI agent scale is breaking identity governance: are your controls ready?
Explore further
19/08/2026 4:39 pm
AI agent governance has become a scale problem before it becomes a maturity problem. The article’s central evidence is that deployment is already near-universal while written policy is still absent for most organisations. That means the market is not waiting for more experimentation, it is waiting for governance that can keep pace with operational reality. For identity leaders, the important shift is that agentic AI is now a lifecycle and entitlement management issue, not a future-state architecture discussion.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What does Zero Trust mean for AI agent identity governance?
A: For AI agents, Zero Trust means every request is authenticated and authorised in context, with access granted only for the specific task and duration required. Long-lived trust, broad entitlements, and reusable tokens all undermine that model. Teams should use Zero Trust to reduce standing privilege and make agent access auditable and disposable.
👉 Read our full editorial: Managing 100,000 AI agents needs a scalable identity model
