Topic starter
24/06/2026 8:42 pm
TL;DR: Opal Security finds that AI coding agents are creating access patterns inside engineering workflows that standard IAM and IGA tools were not built to explain, bound, or audit. The governance gap is moving from static provisioning to runtime ownership, scoped permissions, and auditability for identities that emerge inside development automation.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Opal's Next Chapter: A Conversation with CEO Howard Ting”.
Key questions
Q: How should teams govern AI-assisted development workflows that use coding agents?
A: Treat them as identity-governed execution paths, not just productivity tools.
Q: Why do legacy IAM and IGA tools struggle with AI-assisted development?
A: They were built for slower, more stable access models where a human or service account could be provisioned once and reviewed later.
Q: What breaks when access is created inside automation rather than through IT workflows?
A: The usual separation between identity administration and operational work breaks down.
Practitioner guidance
- Define ownership for every coding agent Assign a clear business or engineering owner to each agent before it can read repositories, update infrastructure, or trigger workflows.
- Scope agent permissions to the workflow Limit each agent to the minimum repository, cloud, and SaaS permissions needed for the task it performs.
- Make access decisions explainable and time-bound Require the governance record to show why access exists, how long it should remain valid, and what usage justified it.
Bottom line: AI coding agents are changing the identity problem from static access administration to runtime governance inside engineering workflows.
What's in the full article
Opal Security's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor maps access across engineering tools, cloud platforms, and AI coding agents
- The specific operating model Opal describes for explainable, time-bound access decisions
- Why the company argues that standard IAM and IGA workflows no longer fit AI-assisted development
- How Opal frames governance for humans, services, and agents in one access model
👉 Read Opal Security's analysis of identity governance for AI coding agents →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:26 am
AI coding agents expose a runtime governance gap, not just an access review problem. The article shows that standard IAM and IGA tools were built for access that changes slowly and can be reviewed after the fact. AI-assisted development introduces identities and permissions inside the workflow, where they are created and consumed too quickly for legacy governance rhythms. Practitioners should treat runtime access creation as the new governance boundary.
A question worth separating out:
Q: Should organisations create separate policies for AI agents and human users?
A: Yes. Human users, customer agents, and internal service identities have different lifecycle, risk, and assurance requirements. A single policy set usually overgeneralises and either blocks useful automation or leaves software actors over-privileged. Separate policy treatment makes ownership, scope, and auditability much clearer.
👉 Read our full editorial: Identity governance for AI coding agents is outgrowing legacy IAM