Topic starter
24/06/2026 11:04 pm
TL;DR: Only 18% of security leaders are highly confident their IAM can manage agent identities, while 44% still rely on static API keys and 21% maintain a real-time inventory, highlighting a production governance gap, according to Strata Identity. Traditional IAM assumptions break when autonomous agents scale faster than ownership, inventory, and accountability structures can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “Securing Autonomous AI Agents starts with identity governance”.
By the numbers:
- Only 18% of security leaders are highly confident their IAM systems can effectively manage agent identities.
- 44% rely on static API keys for agent authentication, a legacy method unfit for autonomous systems.
- Only 21% maintain a real-time inventory of active AI agents in their environment.
Key questions
Q: What breaks when AI agents rely on long-lived API keys?
A: Long-lived keys turn a single leaked secret into persistent authority, and agents create more places for that secret to leak through prompts, logs, cache layers, and tool outputs.
Q: Why do autonomous AI systems create accountability problems for IAM teams?
A: Autonomous AI systems create accountability problems because they can initiate actions, chain tools, and make decisions without a stable human operating moment behind each step.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Define a sponsor for every agent identity Record one accountable owner for onboarding, scope changes, exception approval, and retirement so no agent sits in a shared ownership gap.
- Replace static API keys with short-lived issuance Use short-lived credentials or scoped federation where possible, and restrict any remaining static secrets to tightly bounded exception cases.
- Build live agent inventory into IAM operations Continuously discover active agents, their credentials, and their execution environments so access reviews and incident response have a current system of record.
Bottom line: Autonomous AI agent governance is failing because organisations are trying to manage runtime behaviour with IAM models built for stable, reviewable access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:51 am
Autonomous agent identity governance has crossed from experimental risk to operating-model risk. The survey shows that agent adoption is already moving into production while confidence in IAM coverage remains low. That means the weak point is not one control, but the mismatch between autonomous runtime behaviour and identity processes designed for stable, reviewable access. The practitioner conclusion is straightforward: governance has to be built around agent behaviour, not adapted after the fact.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern human-in-the-loop oversight for autonomous agents?
A: Oversight must be embedded at policy-defined execution thresholds, not treated as a manual review after the agent acts. The control should pause or constrain the workflow before the critical action completes, with explicit criteria for when human approval is mandatory and when automation can proceed.
👉 Read our full editorial: Autonomous AI agent identity governance is still failing in IAM