Topic starter
06/07/2026 9:41 am
TL;DR: AI agents are being deployed into customer support, security operations, and business workflows faster than most organisations can inventory, scope, or monitor them, according to Token Security. The governance gap is not just visibility: identity models built for stable, human-paced access do not fit software that creates and uses privileges at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “NHI & the Rise of AI Agents Uncovering Hidden Security Risks”.
Key questions
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
Q: Why do AI agents create more NHI risk than ordinary developer automation?
A: AI agents can choose actions dynamically, call external services, and chain requests without a human approving each step.
Q: What do teams get wrong about AI agent access reviews?
A: Teams often assume an access review can certify an agent the same way they certify a human or a service account.
Practitioner guidance
- Map every AI agent to an accountable owner Require a named human owner for each AI-driven identity, with documented purpose, intended systems, and approved business use.
- Scope agent permissions to one declared task Bind each AI agent to the minimum access needed for its declared role and block inherited broad permissions from creator accounts or shared service credentials.
- Add AI agent discovery to continuous inventory Track newly created agents, dormant agents, and agents that cross environment boundaries so that inventory stays current as adoption scales.
Bottom line: AI agents are expanding the NHI attack surface because they are created quickly, granted access across multiple systems, and monitored with controls built for slower identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:57 am
AI agent sprawl is becoming an identity governance problem before it becomes an AI governance problem. The article shows that the core failure is not model behaviour alone, but uncontrolled creation of software identities that carry access into production systems. When identities can be stood up quickly by multiple teams, the first loss is governance visibility, and the second is accountability. The practitioner conclusion is that AI agent governance must sit inside identity operations, not outside them.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Why do service accounts and other NHIs complicate GRC implementation?
A: NHIs complicate GRC because they often outnumber human accounts, change outside normal HR-driven lifecycle processes, and carry access that is easy to overlook in reviews. If inventory, ownership, and expiry are incomplete, the GRC programme will miss the most material access risks. That makes NHI governance a core compliance issue, not a niche security task.
👉 Read our full editorial: AI agents expand NHI attack surface faster than IAM can govern