Topic starter
24/06/2026 11:13 pm
TL;DR: Autonomous AI is now taking actions, not just supporting decisions, exposing governance gaps in identity, authorization, and accountability, according to Keyfactor’s AI Identity Edition, which draws on input from 450 security professionals across North America and Europe. The central issue is that trust models built for humans and static machines do not yet hold when agents operate at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Digital Trust Digest: Explore the AI Identity Edition Shaping Security in 2026”.
By the numbers:
- The issue draws on insights from 450 security professionals across North America and Europe.
Key questions
Q: What breaks when autonomous AI is governed like a script?
A: The control model breaks because scripts are usually bounded by predefined steps, while autonomous AI can choose actions, timing, and tool use at runtime.
Q: Why do autonomous AI systems create more identity risk than normal automation?
A: Normal automation follows a fixed path, but autonomous systems can interpret goals, choose actions, and continue without waiting for a person.
Q: How can security teams tell whether AI authority is too broad?
A: Look for agents that can touch sensitive systems, trigger downstream workflows, or reuse the same permissions across multiple tasks without a clear business reason.
Practitioner guidance
- Define explicit AI operating authority Document which AI systems may initiate actions, which actions remain human-approved, and which downstream systems they may touch.
- Map agent permissions to runtime tasks Replace broad, reusable access patterns with task-bounded permissions that match the agent’s real operating scope, then review any permission that outlives the task it was meant to support.
- Automate credential lifecycle for short-lived agents Align issuance, renewal, and revocation with the creation and retirement rate of autonomous systems so identities do not persist longer than the task or environment they control.
Bottom line: Autonomous AI changes identity governance because the control problem shifts from verifying access to bounding independent action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:58 am
Autonomous AI collapses the assumption that identity is passive. Identity programmes were built on the premise that an actor requests access, performs a bounded task, and can be reviewed later. That assumption fails when the actor itself decides when to act, which tools to use, and how far to push the workflow. The implication is that governance has to move from static permission assignment toward runtime authority control.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI as an application or as an identity?
A: Treat it as an identity when the AI can access data, invoke tools, or participate in workflows that affect business systems. That framing makes least privilege, just-in-time access, and lifecycle governance relevant. If you keep treating it only as an application, you will miss the access and delegation behaviours that actually create risk.
👉 Read our full editorial: AI identity edition shows autonomy is outpacing trust controls