Topic starter
06/11/2026 6:37 pm
TL;DR: The controls for securing AI agents are familiar ones: discovery, just-in-time access, runtime authorization, and revocation, according to Newcore across three announcements. NHI Mgmt Group's view is that agent security is less a new category than a test of whether identity governance can keep pace with runtime decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Newcore: “Discovery, Just-in-Time Access, Kill Switches: Agent Security Is Running on the Identity Playbook”.
By the numbers:
- 79% of enterprises run AI agents in production and 2% have deployed purpose-built identity security for them, according to Newcore.
Key questions
Q: What should teams do when an AI agent is found outside governance?
A: They should contain the access path before expanding the agent’s reach, then assign ownership, review the connected secrets and roles, and decide whether the integration belongs in scope at all.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: Why do just-in-time access controls matter for non-human identities?
A: JIT matters because it reduces the time a secret, token, or privileged session remains usable.
Practitioner guidance
- Build an authoritative agent inventory Connect discovery to identity providers, AI platforms, and workflow entry points so sanctioned, unsanctioned, and orphaned agents are visible before policy is applied.
- Replace standing agent access with task-scoped issuance Issue access only for the action being performed, attach a reason or approval condition, and ensure the token expires as soon as the task completes.
- Record the human owner and delegated user for every agent action Log each request, decision, and approval with the agent identity, the human accountable for it, and the user on whose behalf it acted.
Bottom line: AI agent security is collapsing into a familiar identity problem: discover the actor, constrain its privilege, and revoke access cleanly when it is done.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Agent security is really identity governance under runtime pressure. The controls being discussed are familiar because the governance problem is familiar: enumerate the actor, bound its authority, monitor its actions, and revoke access when the task is done. What changes is the tempo, not the discipline. Teams that already manage service accounts, privileged sessions, and access reviews are closer to readiness than the market language suggests.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams revoke an agent's access across multiple systems?
A: Revoke the agent’s delegated authority centrally by disabling its identity, such as its service account, token, API key, or certificate, and then remove its tool entitlements in every connected system. A proper kill switch also stops scheduled jobs, rotates any exposed secrets, and records the human owner who authorised shutdown so the access cannot reappear through a cached session or shadow integration.
👉 Read our full editorial: Agent security is becoming identity governance with a faster runtime