Topic starter
16/01/2026 12:31 pm
TL;DR: AI agents are being adopted faster than enterprises are adapting identity controls, and SailPoint’s survey found 96% of technology professionals already view them as a threat. The governance gap is structural because access review processes assume stable, reviewable privilege, while agents can obtain and use permissions at machine speed and then move on.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Securing AI agents: How to govern your ‘Cyborg Teenagers’”.
By the numbers:
- 96% of technology professionals identified AI agents as a threat in SailPoint and Dimensional Research’s survey.
Key questions
Q: How should security teams implement task-scoped access for multi-agent systems?
A: Start by mapping each sensitive agent action to a specific resource, approval condition, and expiry rule.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Define task-scoped access rules Bind each agent permission grant to a named task, a specific data scope, and an expiry condition that ends when the task ends.
- Separate agent authentication from downstream authorisation Require the agent to authenticate like an application, then govern tool calls, delegated actions, and machine-account use as distinct authorisation decisions.
- Build an agent inventory and ownership model Track every off-the-shelf, custom, and shadow agent in a central directory and assign an accountable owner for behaviour and access decisions.
Bottom line: AI agents are changing the identity problem because they can combine human intent, machine access, and runtime choice in the same execution path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 5:38 pm
Task-scoped identity is now the governing unit for AI agents: Access reviews built for stable users do not map cleanly to agents that obtain rights, act, and expire within one task. The article’s strongest point is that identity governance must move from durable assignment to bounded execution. For practitioners, the relevant control question is no longer who owns the account alone, but what the account is allowed to do for this task and nothing else.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: Should organisations prioritize visibility or least privilege first for AI agents?
A: Organisations should do both, but visibility comes first because you cannot restrict what you cannot find. Once agents, tokens, and delegated workflows are discovered, least privilege can be applied to narrow scope and reduce blast radius. Without discovery, least privilege is incomplete because the hidden population remains unmanaged.
👉 Read our full editorial: AI agent governance needs task-scoped identity controls