Topic starter
04/06/2026 3:03 pm
TL;DR: As AI agents spread across SaaS, cloud, and internal services, organisations are struggling to discover what identities they use, what data they touch, and who owns them, according to Oasis Security. The core issue is no longer model access but identity visibility and lifecycle control across agent-driven actions.
Editorial analysis by NHI Mgmt Group, based on content published by Oasis Security: “How to discover, map, and secure AI Identities”.
Key questions
Q: What breaks when an AI agent is not part of identity inventory?
A: When an AI agent is not part of identity inventory, governance breaks at the point of discovery.
Q: Why does ambiguous ownership create risk for AI identities?
A: Ambiguous ownership matters because accountability is what keeps agent access inside a lifecycle.
Q: How should security teams implement AI agent credential management?
A: Security teams should issue short-lived, task-scoped credentials tied to the specific agent, tool, and resource involved, rather than sharing human sessions or static API keys.
Practitioner guidance
- Inventory every AI service and agent Build a register that ties each agent to its model, connected tools, credentials, data access, and business owner.
- Map agent credentials to owners Require explicit ownership for every agent identity construct, including API keys, OAuth tokens, and service accounts.
- Separate approved from inherited access Identify where agents are using inherited user tokens or broad embedded permissions, then distinguish those cases from registered, purpose-bound access.
Bottom line: AI agents create a governance problem because they act through NHIs, not because they are novel software features.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:16 pm
AI identity governance fails when the control object is the model instead of the agent. The article makes clear that models are only one layer in the access chain, while the agent is the actor using credentials, tools, and workflows across systems. That shifts governance from prompt or model approval to identity attribution, entitlement mapping, and lifecycle ownership. Practitioners should treat AI identity as a governed execution layer, not a feature of the model stack.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 61% of organisations still define privileged users as humans only, overlooking the role of non-human identities in privileged access, according to KPMG.
A question worth separating out:
Q: When do AI identities need lifecycle management beyond normal IAM?
A: AI identities need lifecycle management beyond normal IAM when they can act across systems, inherit user tokens, and persist independently of the creator. In that case, creation, permission mapping, monitoring, and decommissioning all need explicit controls so the agent does not outlive its accountability or business purpose.
👉 Read our full editorial: Discovering and securing AI identities before governance drifts