Notifications
Clear all
Topic starter
12/06/2026 9:19 pm
TL;DR: AI agents are no longer behaving like scripted automation, and JumpCloud’s article argues that identity and access controls must shift from static trust assumptions to supervised, task-scoped governance. That matters because 61% of organisations report unsanctioned AI use, while perceived AI maturity still outpaces real readiness by 18 points.
NHIMG editorial — based on content published by JumpCloud: Zero Trust for AI and the trust trap in autonomous work
By the numbers:
- 61% of organizations report the unsanctioned use of AI tools, creating a sprawling network of Shadow AI.
- Only 22% qualify as fully ready to govern AI at scale, even though 40% of organizations consider themselves AI mature.
- The gap between perceived AI maturity and objective readiness is 18 points.
Questions worth separating out
Q: What breaks when AI agents are governed like scripts or service accounts?
A: What breaks is the assumption that access can be defined once and then safely reused.
Q: Why do AI agents complicate zero trust governance for IAM teams?
A: AI agents complicate zero trust because the trust question shifts from who authenticated to what the actor is doing right now.
Q: How do security teams know whether AI agent governance is actually working?
A: They know it is working when agents stay within tightly bounded tasks, high-risk actions still require human approval, and unsanctioned AI use is being discovered rather than ignored.
Practitioner guidance
- Define separate governance paths for human, machine, and AI identities Classify each actor before assigning controls so that authentication, rotation, lifecycle review, and supervision match the actual identity type rather than the workflow label.
- Issue task-scoped identities for each AI agent Avoid shared or general admin access.
- Require human approval for high-impact agent actions Set explicit approval gates for actions that delete, move, or change production data, and make sure the agent can prepare work but not complete irreversible steps unauthorised.
What's in the full article
JumpCloud's full article covers the operational detail this post intentionally leaves for the source:
- Practical examples of the three identity categories and how they differ in day-to-day governance
- The full Zero Trust for AI framework, including supervised autonomy and probationary access
- JumpCloud's assessment language for evaluating AI readiness across your organisation
- The article's explanation of the 'digital intern' model for scoping agent permissions
👉 Read JumpCloud's analysis of zero trust governance for AI agents →
AI agents and the zero trust governance gap for IAM teams?
Explore further
12/06/2026 11:19 pm
Zero trust for AI agents is an assumption shift, not a policy tweak. Traditional IAM assumes that a subject can be provisioned, reviewed, and governed against a stable job description. That assumption fails when the actor is autonomous because it can interpret vague instructions and alter its own execution path at runtime. The implication is that identity governance must stop treating access as a fixed state and start treating agent behaviour as the control object.
A few things that frame the scale:
- From our research: 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when an AI agent causes unauthorized changes?
A: Accountability should sit with the organisation that defined the agent’s permissions, approval paths, and operating limits. If the agent could act without adequate supervision, the failure is usually governance design, not the model alone. Security, IAM, and platform owners should all be able to explain where the boundary was set and why it was acceptable.
👉 Read our full editorial: Zero trust governance for AI agents is now an identity problem
