Topic starter
17/08/2026 4:36 pm
TL;DR: Forrester’s Customer Identity and Access Management Solutions Landscape, Q3 2026 profiles more than 30 vendors and says agentic AI is the single largest transformational force in CIAM, according to Strivacity’s analysis. The category is moving beyond human login and consent into AI agent onboarding, task-scoped authorization, and continuous session control, which makes legacy CIAM assumptions increasingly fragile.
Editorial analysis by NHI Mgmt Group, based on content published by Strivacity: “Strivacity Named a Notable Vendor in Forrester's 2026 CIAM Landscape Report”.
By the numbers:
- The report profiles more than 30 CIAM vendors.
Key questions
Q: What breaks in CIAM when AI agents can act for customers?
A: What breaks is the assumption that authentication alone defines access.
Q: How do AI agents change the way IAM teams think about authorization?
A: AI agents turn authorization into a runtime delegation problem.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Map agent identities separately from human users Define an explicit identity model for AI agents so the platform can distinguish the customer, the authorising application, and the executing agent without collapsing them into one account.
- Require task-scoped authorization for agent sessions Limit access to the specific action, resource, and duration needed for each agent task, and prevent broad reuse of permissions across unrelated requests.
- Test continuous policy evaluation during active sessions Verify that access can be narrowed or revoked after authentication when task context, risk signals, or consent boundaries change mid-session.
Bottom line: CIAM is being pushed beyond human login because AI agents now need their own identity and authorization boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:43 pm
CIAM is moving from authentication centric design to delegated identity governance. The category can no longer stop at sign-in because AI agents introduce a second actor with its own authority boundary, consent record, and execution context. That shifts CIAM from session admission to runtime governance, where the core question is not just who logged in but who or what is allowed to act. Practitioners should treat this as a redesign of the identity model, not a feature add-on.
A few things that frame the scale:
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: What is the difference between consumer bot detection and agent identity governance?
A: Consumer bot detection asks whether traffic is automated. Agent identity governance asks who authorised the agent, what it is allowed to do, and how its actions are recorded. The first is a traffic classification problem. The second is an identity and access problem that determines accountability, scope, and liability.
👉 Read our full editorial: CIAM is shifting from human login to agent identity governance