Topic starter
19/08/2026 4:07 pm
TL;DR: AWS re:Invent 2025 marked the point where identity moved from a supporting security layer to the control plane for humans, services, and AI agents, according to Ory. The implication is that traditional IAM assumptions about static privileges, fixed workflows, and human-paced governance no longer match modern runtime behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “The control plane shift: What we saw at AWS re:Invent 2025”.
Key questions
Q: What breaks when identity is treated as an administrative task instead of a control plane?
A: When identity is treated as administration, organisations lose sight of how authority is created, inherited, and extended across systems.
Q: Why do static privilege models fail in environments with workloads and AI agents?
A: They assume future access can be predicted at provisioning time.
Q: How can IAM teams tell whether access review coverage is actually meaningful?
A: They should measure what was excluded as well as what was approved.
Practitioner guidance
- Inventory runtime identity decision points Map where identity is used to authorise actions at execution time across humans, workloads and AI agents.
- Review privilege models for dynamic execution Check whether roles, scopes and delegated access still assume stable work patterns.
- Align access reviews to live behaviour Measure whether recertification and approval cycles can see the identity states that matter during real execution.
Bottom line: The article frames identity as part of the runtime control plane, which changes what IAM, IGA and PAM teams need to govern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:40 pm
The control plane shift is an identity governance problem, not just an architecture trend. Once identity becomes the mechanism that decides runtime action across humans, services and AI agents, old IAM boundaries lose explanatory power. The relevant question is no longer who logged in, but which identity decided what could happen next. Practitioners should treat control-plane identity as a governance domain in its own right.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What breaks when human, workload, and agent identities are governed separately?
A: Separate governance creates inconsistent privilege rules, weak traceability, and gaps in accountability across delegation chains. A human may authorise the workflow, a workload may execute it, and an agent may choose the next step, so policy fragmentation quickly becomes a control failure.
👉 Read our full editorial: The control plane shift at re:Invent 2025 reshapes identity governance