Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Identity security is shifting from static least-privilege policy to runtime governance for AI agents, shadow AI, and cloud-connected access paths, with a practical focus on discovery, control, and lifecycle management across Microsoft Copilot Studio, Bedrock, Azure AI Foundry, and Vertex AI, according to Veza. The central issue is that AI agent identity assumptions break when tools, permissions, and execution timing are no longer human-paced or predictable.
NHIMG editorial — based on content published by Veza: AI The Identity Security Maturity Model: A Roadmap to Least Privilege
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents complicate least-privilege design?
A: AI agents complicate least-privilege design because their tool use can change dynamically while the underlying permissions remain persistent.
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Practitioner guidance
- Inventory every AI-connected access path Map agents, connectors, service accounts, and API tokens together so hidden permissions do not sit outside IAM review scope.
- Tie agent permissions to runtime use cases Document which tools and data sources each agent can reach during execution, then compare that with the access granted at provisioning time.
- Extend access review to shadow AI Require periodic review of undiscovered or loosely governed AI workloads, including who owns them, what they can access, and whether the permissions are still justified.
What's in the full article
Veza's full article set covers the operational detail this post intentionally leaves for the source:
- Step-by-step AI agent security coverage for Microsoft Copilot Studio, Amazon Bedrock Agents, Azure AI Foundry, and Google Cloud Vertex AI.
- Product-level access graph and discovery details that show how Veza maps AI-driven permissions across cloud services.
- Shadow AI management specifics for identifying and governing undiscovered agents and their credentials.
- Identity maturity roadmap material that connects least privilege concepts to practical AI security implementation.
👉 Read Veza's analysis of AI agent identity security and least privilege maturity →
AI agent security and least privilege maturity: what changes now?
Explore further
25/08/2026 6:11 pm
AI agent security is now an identity governance problem, not an adjacent AI feature problem. The article set points to a shift from model-centric thinking to access-centric thinking, where the risk is created by delegated permissions, connector sprawl, and hidden runtime actions. That makes AI agents part of the NHI estate whether the organisation labels them that way or not. Practitioners should treat agent access as governed identity, not experimental automation.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which shows how wide the operational gap still is.
A question worth separating out:
Q: How do IAM teams decide whether an AI agent should be treated like an NHI?
A: If the agent receives credentials, requests tokens, or calls APIs without human approval at each action, it should be treated as an NHI for governance purposes. That brings lifecycle, scope, logging, and revocation into the identity programme. The decision is based on execution behaviour, not on whether the system is branded as AI.
👉 Read our full editorial: AI agent identity security and least privilege maturity
