Topic starter
19/08/2026 3:47 pm
TL;DR: CIAM is being reshaped by agentic AI, passkey UX friction, mobile authentication constraints, modular API-first architecture, and rising sovereignty demands, according to Ory. The core challenge is not whether identity controls exist, but whether they still hold when machine-scale actors, cross-device recovery, and cross-border data obligations collide.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “Top 5 CIAM trends in 2026: Agentic AI, passkeys & more”.
Key questions
Q: What breaks when CIAM still assumes every actor is a human user?
A: Human-centred CIAM fails when the actor can operate at machine speed, change context without warning and generate far more identity events than a person.
Q: Why do agentic AI systems complicate access control and auditability?
A: They complicate access control because behaviour is probabilistic, not fixed, so the same inputs can lead to different actions.
Q: How should organisations handle passkey recovery across new devices and old accounts?
A: They should treat recovery as part of the control design, not an exception path.
Practitioner guidance
- Define an agent identity model Separate human, workload and agent identities in CIAM so authorization, consent and audit trails can be bound to the correct actor type.
- Map recovery-path failure points Test device migration, lost email access and cross-platform credential sync to find where passkey recovery fails before users do.
- Rework mobile sign-in patterns Avoid embedded browser flows where possible and choose native app, browser or progressive web app patterns based on the authentication signal you need.
Bottom line: Agentic AI, passkeys and sovereignty requirements are colliding with CIAM designs that still assume a human user, a single device and a predictable recovery path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:23 pm
Machine-scale CIAM changes the control problem, not just the load profile: The article shows that agents can drive millions of identity operations where human users would generate thousands. That shifts the design constraint from user convenience to issuance, authorization and logging at machine speed. Practitioners should treat agent identity volume as a governance boundary, not an infrastructure footnote.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should teams prioritise modular CIAM architecture over a single platform approach?
A: When standards, device behaviour and regulatory demands are still changing, modular architecture reduces rework and allows individual components to evolve without a full replacement. It also gives teams more control over authentication UX, sovereignty options and future protocol adoption.
👉 Read our full editorial: CIAM in 2026: agentic AI, passkeys and sovereignty gaps