Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: AI agents now outnumber human identities 80:1 in the average enterprise, while 92% of deployments still lack access review or recertification cycles, according to Saviynt, exposing a governance model built for human-paced identity rather than machine-speed execution. Existing IGA, PAM, and SoD controls break when agents can act autonomously, chain permissions, and operate without lifecycle hooks or human oversight.
NHIMG editorial — based on content published by Saviynt: Beyond Human Access: Governing the Rise of the AI Workforce
By the numbers:
- AI agents now outnumber human identities 80:1 in the average enterprise.
- 92% of AI agent deployments have no access review or recertification cycle.
Questions worth separating out
Q: What breaks when AI agents are governed like ordinary service principals?
A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns.
A: Priority should shift as soon as agents can make context-dependent decisions across systems.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Build an authoritative AI agent registry Inventory every deployed, embedded, and shadow agent with owner, mandate scope, credential inventory, access footprint, lifecycle status, and last review date.
- Shift enforcement to task-scoped access decisions Require short-lived OAuth tokens, SPIFFE SVIDs, or mTLS certificates with per-task scope binding, and broker them only at task time through PAM or a secrets manager.
- Extend access reviews to agent chains Model orchestrators and sub-agents together so certification and SoD checks evaluate combined permissions, not isolated identities.
What's in the full article
Saviynt's full blog post covers the operational detail this post intentionally leaves for the source:
- A 90-day phased roadmap for agent discovery, IGA extension, PAM adaptation, and board-level reporting.
- The CIAM decision model for task, data, temporal, behavioural, and environmental context checks.
- Examples of intent claims, access decisions, and risk-adaptive thresholds for sensitive workflows.
- The incident response playbooks for credential compromise, prompt injection, scope expansion, and SoD violations.
👉 Read Saviynt's analysis of AI workforce identity governance →
AI workforce governance: are your IAM controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
14/09/2026 10:10 am
AI workforce governance is now an identity problem, not an automation problem. Once software actors can request, combine, and use access across systems, the question changes from whether a workflow runs to whether the actor should be trusted with that workflow at all. That places AI agents squarely inside NHI governance, with lifecycle, privilege, and accountability controls becoming the real boundary conditions. Practitioners should stop treating agent access as an extension of service accounts.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which is why delegated access remains a recurring blind spot in identity governance.
A question worth separating out:
Q: How should security teams implement AI agent credential management?
A: Security teams should issue short-lived, task-scoped credentials tied to the specific agent, tool, and resource involved, rather than sharing human sessions or static API keys. The control objective is to limit what the agent can do, preserve attribution, and make revocation practical when behaviour changes or becomes suspicious.
👉 Read our full editorial: AI workforce governance exposes the limits of human-era IAM
