Topic starter
14/09/2026 10:10 am
TL;DR: AI agents now outnumber human identities 80:1 in the average enterprise, while 92% of deployments still lack access review or recertification cycles, according to Saviynt, exposing a governance model built for human-paced identity rather than machine-speed execution. Existing IGA, PAM, and SoD controls break when agents can act autonomously, chain permissions, and operate without lifecycle hooks or human oversight.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Beyond Human Access: Governing the Rise of the AI Workforce”.
By the numbers:
- Non-human identities now outnumber human identities 80:1 in the average enterprise.
- 92% of AI agent deployments have no access review or recertification cycle.
Key questions
Q: What changes when AI agents are governed like ordinary service accounts?
A: The control model becomes too slow.
Q: Why do AI agents increase access risk even when they are visible?
A: Because visibility does not reduce privilege on its own.
Q: What signals show that an AI governance programme is not working?
A: Warning signs include disconnected models built by different teams, repeated disputes over data ownership, inconsistent approvals and outputs that cannot be explained to stakeholders.
Practitioner guidance
- Build a complete AI agent inventory Enumerate every agent deployed by development teams, embedded in SaaS platforms, or running as shadow deployments.
- Extend recertification to agent identities Define agent entity types in your IGA model and create certification workflows that can approve, revoke, or constrain access based on actual agent scope rather than human job roles.
- Broker privileged access at task time Move high-risk credentials out of agent configs and into PAM vaulting or a secrets manager, then issue them only when the agent’s task and intent claim satisfy policy.
Bottom line: AI workforce governance fails when organisations apply human-era IAM to autonomous agents that can act, branch, and persist without HR-linked lifecycle events.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Human-era IAM assumptions collapse when the principal is an autonomous agent. Identity governance was built around people who are onboarded, certified, and offboarded through stable lifecycle events. AI agents can be cloned, reconfigured, and shut down without any comparable governance signal. The implication is not a tuning exercise. It is a redesign of what counts as an identity object in the first place.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: How do security teams spot over-privileged AI agents in practice?
A: Look for agents that routinely cross system boundaries, reuse the same credential across unrelated tasks, or access more data sources than the original workflow requires. Those patterns show that the entitlement scope has drifted beyond the intended use case and is no longer defensible in review.
👉 Read our full editorial: AI workforce governance exposes the limits of human-era IAM