Notifications
Clear all
Topic starter
19/08/2026 4:07 pm
TL;DR: AWS re:Invent 2025 marked the point where identity moved from a supporting security layer to the control plane for humans, services, and AI agents, according to Ory. The implication is that traditional IAM assumptions about static privileges, fixed workflows, and human-paced governance no longer match modern runtime behaviour.
NHIMG editorial — based on content published by Ory: The control plane shift: What we saw at AWS re:Invent 2025
Questions worth separating out
Q: How should security teams govern identity as a control plane?
A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate.
Q: Why do traditional IAM controls struggle with autonomous AI agents?
A: Traditional IAM assumes predictable users or static machine accounts, but AI agents can act independently, interact with multiple systems, and generate new access needs over time.
Q: What breaks when machine identity and delegated authority are treated as the same thing?
A: You lose the ability to distinguish authentication from permission to act.
Practitioner guidance
- Map identity control-plane responsibilities Document which team owns authentication, authorisation, lifecycle review, and runtime policy for humans, service accounts, and agents.
- Separate machine authentication from machine authority Review non-human identities to confirm that successful authentication does not automatically imply broad tool use, data access, or action execution.
- Inventory delegated access paths end to end Trace how access flows from users to services to automated systems and agentic components, including any handoffs across clouds, APIs, and MCP-connected tools.
What's in the full article
Ory's full blog post covers the operational detail this post intentionally leaves for the source:
- The article’s framing of Gen III security and how the vendor connects it to identity becoming the control plane.
- The specific platform and ecosystem references around Ory Agent Security, Ory MCP Server, and machine-to-machine auth.
- The surrounding product and ecosystem context that explains how the vendor is positioning agentic AI and IAM together.
- The exact event and source material from AWS re:Invent 2025 that informed the post’s viewpoint.
👉 Read Ory's analysis of the control plane shift at AWS re:Invent 2025 →
AWS re:Invent 2025 and the control plane shift for IAM teams?
Explore further
19/08/2026 4:40 pm
Identity governance is becoming control-plane governance, not just access governance. That is the real significance of this article’s thesis. When humans, services, and AI agents share one operational plane, identity policy starts shaping system behaviour in real time rather than merely recording who signed in. IAM leaders should read this as a programme design shift, not a tooling trend.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, showing that control design and control behaviour are still misaligned.
A question worth separating out:
Q: Which frameworks help teams evaluate identity governance and zero trust together?
A: NIST Cybersecurity Framework 2.0 and the OWASP Non-Human Identity Top 10 are useful starting points because they connect governance, access control, and identity risk. Teams should use them to compare lifecycle coverage, recovery assurance, and least-privilege enforcement across human and non-human identity processes.
👉 Read our full editorial: The control plane shift at re:Invent 2025 reshapes identity governance
