Notifications
Clear all
Topic starter
19/08/2026 3:38 pm
TL;DR: AI agents usually inherit access through applications, APIs, service accounts, machine identities, and user roles rather than receiving permissions directly, creating hidden overreach and weak accountability, according to BigID. The real governance problem is that access reviews and AI identity controls still assume a stable, explainable permission path, which inherited access often obscures.
NHIMG editorial — based on content published by BigID: How AI Agents Inherit Permissions
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams manage permissions for AI agents?
A: Security teams should regularly assess and update the permissions granted to AI agents to ensure they align with their intended scope.
Q: Why do AI permissions create more risk when they inherit access from other systems?
A: Inherited access is risky because the AI layer often borrows trust without inheriting the original governance discipline.
Q: What do organisations get wrong about AI governance and identity controls?
A: They often separate AI governance from identity governance, even though AI systems can shape access, code, and security decisions.
Practitioner guidance
- Inventory AI permission chains end to end Trace each AI-enabled workflow from user or system entry point through application, API, service account, machine identity, and data target.
- Extend access reviews to AI identities and transitive access Add AI systems, copilots, and autonomous workflows to certification cycles alongside the identities they depend on.
- Rebaseline service account and machine identity scope Reduce broad permissions on the accounts that AI depends on, especially where tokens, secrets, or workload identities connect to sensitive repositories or privileged APIs.
What's in the full article
BigID's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how permissions flow through applications, APIs, service accounts, machine identities, and user roles.
- Concrete examples of the AI permission chain that teams can use to map inherited access in their own environments.
- Guidance on identifying excessive access and connecting AI identities to sensitive data exposure during implementation.
- Operational framing for AI Identity Governance and AI Access Governance programmes.
👉 Read BigID's analysis of inherited AI permissions and AI access governance →
AI permission chains: what IAM teams need to know now?
Explore further
19/08/2026 4:18 pm
Inherited AI access is really an NHI governance problem wearing an AI label. The article describes a familiar pattern: software systems gaining permissions through existing identities instead of explicit AI-specific authorisation. That means the real control failure is not the model, but the underlying non-human identity estate that was already too broad, too opaque, or too loosely owned. Practitioners should read this as an NHI inventory and governance issue first, and an AI issue second.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: How does identity governance change when AI identities enter the mix?
A: AI identities force governance teams to manage more subjects, more access paths, and more change than human-only programmes were designed for. That means data models, approvals, and automation have to scale beyond workforce assumptions. Organisations should plan for identity diversity now, because AI growth will expose governance designs that were built for a smaller world.
👉 Read our full editorial: Inherited AI permissions are the hidden risk in AI governance
