Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Machine identities already outnumber human identities in many environments, and SSH Communications Security says AI agents are accelerating the move from privileged users to privileged actions. The key governance shift is using short lived certificates plus context aware authorisation so access exists only for the task, not as a reusable standing secret.
NHIMG editorial — based on content published by SSH Communications Security: Ephemeral certification and AI agents are reshaping privileged access
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How can teams govern machine identities and AI agents in access reviews?
A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when privileged access still depends on long-lived secrets?
A: Long-lived secrets create standing privilege, which means compromise windows stay open long enough for attackers to harvest, reuse, and spread access.
Practitioner guidance
- Define action-scoped access use cases Map each privileged task to the exact resource, action, and duration required.
- Constrain AI agents to pre-approved execution envelopes Limit agent access to named tools and named data domains, and require policy evaluation for each step that could expand scope.
- Replace reusable secrets with ephemeral credentials Prioritise workloads, service accounts, and AI integrations that still rely on passwords, SSH keys, or long-lived certificates.
What's in the full article
SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:
- How ephemeral certificates are issued and expired in practice across privileged workflows
- The webinar discussion of privileged actions versus privileged users in AI-enabled environments
- The policy context for context-aware access decisions involving machines, workloads, and AI agents
- The practical framing of zero trust, least privilege, and zero standing privilege in mixed identity environments
Ephemeral certification for AI agents: are your privileged access controls ready?
Explore further
02/09/2026 1:30 pm
Privilege is becoming an action problem, not just an account problem. The article is right to shift the centre of gravity from privileged users to privileged actions. That matters because AI agents and workloads are often the systems actually making access decisions at runtime, while human governance still assumes a named administrator behind every sensitive action. The implication is that PAM and IAM teams need to measure what an identity can do in the moment, not only what role it was assigned at birth.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: What should organisations check before rolling out zero standing privilege at scale?
A: They should check whether approvals, expiry rules, and review workflows can all operate on the same task boundary. If the tooling cannot express task completion cleanly, the programme will fall back to manual workarounds and broader permissions. Zero standing privilege scales only when the policy model is precise enough to remove access automatically.
👉 Read our full editorial: Ephemeral certification and AI agents are reshaping privileged access
