Topic starter
12/02/2026 9:28 pm
TL;DR: AI agents are being connected to SaaS apps, APIs, MCP servers, and internal systems so quickly that temporary trust decisions often become permanent, leaving overprivileged OAuth grants, long-lived tokens, and shared service accounts in place, according to Valence Security. The security problem is not adoption itself but unmanaged non-human identity sprawl and weak permission review.
Editorial analysis by NHI Mgmt Group, based on content published by Valence Security: “Love is in the Air and So Are Your AI Agents”.
By the numbers:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
Key questions
Q: What breaks when AI agents are granted SaaS access for testing and never reviewed again?
A: Temporary approvals become permanent delegated trust, which means the agent keeps scopes, tokens and service-account access long after the original experiment ends.
Q: Why do AI agents increase risk in SaaS environments?
A: AI agents increase risk because they can operate through existing application permissions and continue using them as tasks change.
Q: How can security teams tell whether AI agent access is drifting out of scope?
A: Look for agents touching systems, data sets, or tools that are outside the intended task boundary, especially when those actions are not part of the approved workflow.
Practitioner guidance
- Map every AI agent to an accountable owner Build an inventory of agents, the SaaS apps they touch, and the non-human identities they use.
- Review OAuth grants and token lifetimes together Audit scope, refresh token duration and downstream app-to-app trust as one control set.
- Recertify agent access at lifecycle change points Trigger reviews when an agent moves from pilot to production, changes function, or is embedded in a new workflow.
Bottom line: AI agents in SaaS create a governance gap when experimental access persists into production without fresh review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:02 pm
AI agents in SaaS are exposing an NHI trust gap, not an AI novelty gap. The problem is that organisations are approving delegated access faster than they can govern it, then discovering that the resulting identity behaves like durable production access. That is why the issue sits squarely in NHI governance, not just SaaS posture management. Practitioners need to treat agent identity as a lifecycle problem with ownership, expiry and revocation tied to actual use.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat agent access reviews the same as human access reviews?
A: No. Human reviews focus on role, business need, and employment status, while agent reviews must also cover tool scope, credential inheritance, and downstream action paths. The review object is not just the agent itself but the full execution chain it can initiate. That distinction matters because agent behaviour can change faster than a standard recertification cadence can capture.
👉 Read our full editorial: AI agents in SaaS are creating a new NHI trust gap