Topic starter
10/06/2026 10:50 pm
TL;DR: Gartner’s 2026 Hype Cycle for Agentic AI finds only 17% of organisations have deployed AI agents, while 42% expect to do so within 12 months and another 22% within the following year, even as governance, security and financial management controls remain immature, according to 1Password. Access review models assume intent and timing are known before execution begins, but agentic systems break that premise.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “Our takeaways from the Gartner® Hype Cycle for Agentic AI report”.
By the numbers:
- Only 17% of organisations have deployed AI agents so far, according to Gartner research cited by 1Password.
- 42% expect to deploy AI agents in the next 12 months, according to Gartner research cited by 1Password.
- Another 22% expect to deploy AI agents within the following year, according to Gartner research cited by 1Password.
Key questions
Q: What breaks when AI agents inherit access from users and service accounts?
A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern.
Q: Why do AI agents create risk even when they stay within approved permissions?
A: AI agents can be authorised correctly and still produce harmful outcomes because permission is not the same as intent or behavioural appropriateness.
Q: What do security teams get wrong about governing AI agents?
A: They often treat agents like another automation layer instead of governed non-human actors with their own access paths.
Practitioner guidance
- Define a minimum-permission profile for each agent Map each agent to the smallest permission set required for its specific task, then tie that scope to a documented business purpose and an explicit owner.
- Bind credentials to the agent lifecycle Set issuance, validity and revocation rules so credentials expire when the agent is retired, re-scoped or no longer trusted.
- Place approval gates before irreversible actions Require human authorisation before code deployment, production data changes or other non-reversible tasks, and prevent the agent from self-approving those steps.
Bottom line: Agentic AI turns identity governance into a runtime control problem because permissions can be consumed faster than traditional review cycles can observe them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
12/06/2026 4:32 am
Access review was designed for access that persists long enough to be reviewed. That assumption fails when agents can obtain, use and discard privileges within a single task flow, or pass them through subagents before any certification cycle begins. The implication is not merely that access reviews need modernization, but that review-based governance no longer describes the control boundary for agentic execution.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations preserve accountability across orchestrator and subagent chains?
A: They should preserve one continuous approval chain from the human decision through the orchestrator and into each delegated step. That means recording who authorised the action, which credentials were used and which subagents inherited the work. Without that evidence, accountability fragments across identity contexts and the organisation loses a defensible audit trail.
👉 Read our full editorial: Agentic AI governance gaps are widening as adoption accelerates
This post was modified 3 days ago by NHI Mgmt Group