Topic starter
30/07/2026 11:21 pm
TL;DR: AI agents are accelerating credential discovery, permission abuse, and attack propagation across hybrid identity environments, while identity teams are also being asked to harden recovery and boundary controls before failure, during active attack, and after compromise, according to Semperis. The central issue is not AI adoption itself, but the collapse of identity assumptions when agents can act at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Checklist: Prepare Your Identity Fabric for the Agentic Era”.
By the numbers:
- Identity-based attacks rose 32% in just the first half of 2025, according to Microsoft.
Key questions
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
Q: Why do AI agents increase identity risk even when the login succeeds?
A: A successful login only proves that the agent reached the system.
Q: How should teams reduce the blast radius of AI coding agents in production-adjacent systems?
A: Teams should restrict agent credentials to the smallest possible scope, separate staging from production authority, and keep backups outside the same writable boundary as live data.
Practitioner guidance
- Harden hybrid identity seams Map every IdP in use, including AD, Entra ID, Okta, and Ping, and identify where agents or service accounts can move between them without a clear control boundary.
- Replace standing access with task-scoped access Apply just-in-time and just-enough access to agents, users, and sensitive resources so credentials expire with the task rather than persisting as standing privilege.
- Separate recovery from the compromised fabric Maintain immutable identity-specific backups and a cleanroom restoration path so identity can be trusted before the wider environment is rebuilt.
Bottom line: AI agents are turning identity fabric into the main control boundary because they can exploit credentials and excess permissions at machine speed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:24 pm
Identity fabric is now the primary security boundary for agentic AI: once an agent can log on, the real question is whether the identity fabric can constrain what it can do at machine speed. The article shows that identity providers, service accounts, privileged access, and recovery paths now behave like one coupled control surface. Practitioners should think about identity as the execution environment, not just the authentication step.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can teams tell whether identity controls are keeping up with AI native change?
A: Teams can tell by measuring whether they can answer who acted, what they accessed, and whether the access still matched the task in real time. If those answers depend on manual reconstruction after the fact, the control model is behind the operating model. Drift, shadow access, and ownership gaps are the warning signs.
👉 Read our full editorial: AI agents are exposing identity fabric gaps at machine speed