Topic starter
19/08/2026 4:05 pm
TL;DR: A recent survey found that 98% of organisations already use or plan to use AI agents, while 79% still lack documented policies for governing them, highlighting how quickly agentic adoption is outrunning identity controls, according to Ory and EMA. The governance problem is no longer theoretical: access, ownership, and revocation assumptions built for slower human and service-account lifecycles do not hold at agent scale.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “Managing Agentic Identities at Scale: What Will You Do When You Have 10,000 AI Agents? (And then 100,000? or a Million?)”.
By the numbers:
- 98% of respondents were in production, had a pilot program, or were planning one for AI agents.
- 79% of those organisations lack written policies for governing AI agents.
Key questions
Q: What breaks when an AI agent is deployed without formal ownership?
A: When an AI agent has no formal owner, review, offboarding, and incident response all become slower and less reliable.
Q: Why do service accounts and AI agents create different identity risk than employees?
A: Service accounts and AI agents create different risk because they are not managed through HR lifecycle events, yet they often hold broad technical permissions and can act at machine speed.
Q: How can organisations tell whether AI agent governance is actually working?
A: Look for evidence that agent access is ephemeral, traceable, and constrained at the action level.
Practitioner guidance
- Define agent identities at creation Assign each AI agent a unique identity, owner, purpose, and expiry condition before it is allowed into production workflows.
- Eliminate shared agent credentials Replace shared tokens and hardcoded secrets with individually scoped credentials that can be revoked without affecting unrelated services.
- Make revocation operationally survivable Map downstream dependencies so that token rotation or identity shutdown does not break hidden production integrations.
Bottom line: AI agent adoption is already ahead of governance, and that gap is now a production identity problem rather than a future planning issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:39 pm
Agentic identity governance fails when organisations treat AI agents as temporary automation. The article shows that agents are already in production, but the governance model remains anchored to pilot-era assumptions about ownership, review, and revocation. That gap is now large enough to create systemic identity risk, not just isolated policy failures. Practitioners should treat agent identity as a first-class lifecycle domain.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when AI agents use shared credentials across workflows?
A: Accountability belongs to the organisation that owns the credential lifecycle and the policy attached to it. When shared secrets are used across humans, agents, and machines, the governance model must still identify which actor used the credential, under what approval path, and for what task. Without that, accountability becomes ambiguous.
👉 Read our full editorial: Managing 100,000 AI agents needs a scalable identity model