Notifications
Clear all
Topic starter
22/07/2026 4:33 pm
TL;DR: As organisations deploy more AI agents, identity governance is shifting from manual, policy-only review cycles toward context-aware access decisions at machine speed, according to Linx Security. Traditional IAM models were built for human-paced approvals, but agentic workflows now require governance for both humans and non-human identities.
NHIMG editorial — based on content published by Linx Security: AI-Powered Security, "The Future of Identity Is AI-Native."
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should organisations govern AI agent access without losing operational speed?
A: Use task-scoped access, explicit human ownership, and runtime monitoring together.
Q: Why do policy-only IAM models struggle with AI-native access decisions?
A: Policy-only models assume access can be determined ahead of time from roles and rules.
Q: What breaks when human-style access review is applied to agentic workflows?
A: The review cycle often arrives after the access has already been used and released.
Practitioner guidance
- Define AI agents as governed identities Create an inventory entry for every production AI agent, including owner, business purpose, approved tools, credential type, and revocation path.
- Shift high-risk access to just-in-time controls Reserve standing privileges for the smallest possible set of low-risk tasks.
- Separate policy authoring from runtime authorisation Keep static policy as the baseline, but add runtime context for task, peer group, project, and data sensitivity.
What's in the full article
Linx Security's full article covers the operational detail this post intentionally leaves for the source:
- How the vendor frames agentic access control versus traditional policy-driven IAM in its platform model.
- The examples it gives for human and agent access decisions across customer service, orchestration, and data processing.
- The way it describes autonomous agents learning organisational context and exception patterns over time.
- The specific webinar and product messaging that sit behind the editorial argument.
👉 Read Linx Security's analysis of AI-native identity access control →
AI-native access control for agents: what IAM teams need to know?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
30/07/2026 10:55 pm
AI-native access control is not a UI layer on top of IAM, it is a different operating model. Traditional identity programmes assume policy can be authored ahead of time and then enforced consistently. Agentic access control shifts the centre of gravity to runtime context, which means identity decisions become dynamic rather than purely declarative. That changes how teams design governance, auditability, and exception handling, especially where humans and non-human identities share workflows. The practitioner conclusion is that identity architecture now has to be built around decision velocity, not only policy coverage.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when an AI agent accesses regulated data improperly?
A: Accountability sits with the teams that govern the agent's identity, the data classification, and the policy that allowed the access path. If those controls are disconnected, no single owner can explain why the access existed or why it was not removed sooner. Shared context is what makes accountability traceable.
👉 Read our full editorial: AI-native identity access control is replacing policy-only IAM
