Notifications
Clear all
Topic starter
09/07/2026 1:41 pm
TL;DR: Federal agencies now face an identity problem that spans humans, service accounts, and AI agents, with the article arguing that FedRAMP High authorization proves control maturity rather than eliminating risk, according to Delinea. The deeper issue is that point-in-time compliance and human-paced review cycles do not keep up when agents can request, escalate, and use access at runtime.
NHIMG editorial — based on content published by Delinea: What FedRAMP High authorization actually proves about identity risk
By the numbers:
- NHIs, service accounts, bots, and now AI agents out number Federal personnel by more than 20 to 1, per Federal News Network’s recent reporting on Federal insider risk.
- In 80% of cases, security teams can’t fully explain why an agent took a privileged action, per Delinea’s 2026 Identity Security report.
Questions worth separating out
Q: What does FedRAMP High actually prove about identity risk?
A: FedRAMP High proves that a system met a defined control baseline at the time of assessment, but it does not prove that identity risk is fully governed.
Q: Why do AI agents create a different IAM problem than service accounts?
A: AI agents can decide what to do in the moment, request access they were not explicitly granted, and expand privilege based on context.
Q: How should federal teams measure whether privileged access is actually controlled?
A: They should measure whether every privileged identity has a named owner, a clear purpose, session monitoring, and a revocation path that works during active use.
Practitioner guidance
- Inventory every non-human identity with mission access Build a complete register of service accounts, bots, certificates, and AI agents, then tie each one to a named owner and business purpose.
- Separate authorization evidence from runtime visibility Do not accept a FedRAMP package or audit trail as proof that identity risk is understood.
- Enforce machine-speed revocation for privileged access Design PAM workflows so access can be denied or removed while a session is active, especially for AI agents that can change behaviour mid-session.
What's in the full article
Delinea's full blog post covers the operational detail this post intentionally leaves for the source:
- How the FedRAMP High authorization path is being used to support federal PAM procurement and deployment decisions.
- The article's explanation of how JIT provisioning, session monitoring, and policy enforcement work together in practice.
- Delinea's framing of how AI agents alter the access-control model compared with service accounts and bots.
- The comparison it draws between annual assessment cycles and continuous validation for identity governance.
👉 Read Delinea’s analysis of FedRAMP High, PAM, and AI agent identity risk →
FedRAMP High and AI agent access: what federal IAM teams should note?
Explore further
09/07/2026 1:45 pm
FedRAMP High proves control alignment, not identity completeness. Authorization tells agencies that a system met a defined baseline at a point in time. It does not prove that every service account, bot, or AI agent is inventoried, owned, and explainable across its full lifecycle. The practitioner implication is straightforward: treat compliance as necessary evidence, not as proof that identity risk is contained.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why privileged access programmes so often overestimate control coverage.
A question worth separating out:
Q: Who is accountable when an AI agent uses privileged access outside expectations?
A: Accountability must stay with the programme that approved the identity, its owner, and the policy that allowed the access. If the environment cannot tie actions back to a responsible owner and a revocable entitlement, governance has failed even if the audit passed.
👉 Read our full editorial: FedRAMP High exposes the identity gap in federal AI agent access
