Topic starter
22/07/2026 4:33 pm
TL;DR: As organisations deploy more AI agents, identity governance is shifting from manual, policy-only review cycles toward context-aware access decisions at machine speed, according to Linx Security. Traditional IAM models were built for human-paced approvals, but agentic workflows now require governance for both humans and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Linx Security: “The Future of Identity Is AI-Native”.
Key questions
Q: How should organisations govern AI agent access without losing operational speed?
A: Use task-scoped access, explicit human ownership, and runtime monitoring together.
Q: Why do policy-only IAM models struggle with AI-native access decisions?
A: Policy-only models assume access can be determined ahead of time from roles and rules.
Q: What breaks when access reviews are used for agents that act at machine speed?
A: The review process breaks because it depends on privilege persisting long enough to be observed, certified, and remediated.
Practitioner guidance
- Map AI agent access paths Inventory every workflow where an AI agent authenticates, calls tools, or touches data services, then identify which access decisions are currently handled by static IAM policy versus runtime context.
- Separate human reviews from machine execution Keep human approval for high-risk exceptions, but move routine access decisions for low-risk agent tasks into contextual, auditable automation with clear revocation rules.
- Define context inputs for authorisation Document which signals the platform can trust for access decisions, such as role, project, peer group, and workload state, and reject policies that ignore runtime context.
Bottom line: Policy-only IAM is increasingly mismatched to AI agents because access decisions now have to happen at machine speed and within task context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:55 pm
Policy-only IAM is no longer sufficient when access decisions must happen inside the task, not around it. Traditional review cycles assume enough time exists for a human to evaluate access before use. AI agents collapse that timeline, so the governance model that waits for approval becomes structurally misaligned with execution reality. The practitioner implication is that access control has to move closer to issuance and context evaluation.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: What is the difference between human approval workflows and contextual authorisation for agents?
A: Human approval workflows pause execution until a person decides, while contextual authorisation evaluates runtime signals automatically and permits only the access needed for the current task. That distinction matters when production work cannot wait for a queue.
👉 Read our full editorial: AI-native identity access control is replacing policy-only IAM